NL-21-0019, Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors

Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, Risk-informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors

ML21064A526
Person / Time
Site:	Farley
Issue date:	03/02/2021
From:	Gayheart C Southern Nuclear Operating Co
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-21-0019
Download: ML21064A526 (151)

Text

~ Southern Nuclear March 2, 2021 Docket Nos.: 50-348 50-364 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D. C. 20555-0001 Cheryl A. Gayheart Regulatory Affairs Director Joseph M. Farley Nuclear Plant - Units 1 and 2 3535 Colonnade Parkway Binningharn, AL 35243 205 992 5316 tel 205 992 7601 fax cagayhea@southemco.com NL-21-0019 Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors" Ladies and Gentlemen:

By letter dated June 18, 2020, Southern Nuclear Operating Company (SNC) submitted an application to modify the Joseph M. Farley Nuclear Plant (Farley) licensing basis, by the addition of a License Condition, to allow for the implementation of the provisions of Title 10 of the Code of Federal Regulations (10 CFR), Part 50.69, "Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors."

By email dated January 12, 2021, the Nuclear Regulatory Commission (NRC) staff issued a request for additional information (RAI). Enclosure 1 to this letter provides the SNC response to the NRC staffs RAI. Enclosure 2 provides referenced Electric Power Research Institute (EPRI)

Report 3002017583, "Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization".

The conclusions of the No Significant Hazards Consideration and Environmental Consideration contained in the original application have been reviewed and are unaffected by this response.

This letter contains no NRC commitments. If you have any questions, please contact Jamie Coleman at 205.992.6611.

I declare under penalty of perjury that the foregoing is true and correct. Executed on the 2nd day of March 2021.

Respectfully submitted, Cheryl G h art Director, Regulatory Affairs Southern Nuclear Operating Company CAG/RMJ

U.S. Nuclear Regulatory Commission NL-21-0019 Page 2

Enclosures:

1. SNC Response to NRC RAI

2. EPRI Report 3002017583 cc:

Regional Administrator, Region ll NRR Project Manager - Farley Senior Resident Inspector - Farley Director, Alabama Office of Radiation Control RTYPE: CFA04.054

Joseph M. Farley Nuclear Plant - Units 1 and 2 Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors" SNC Response to NRC RAI to NL-21-0019 SNC Response to NRC RAI E1-1 NRC RAI 1:

Paragraph (b)(2)(ii) of 10 CFR 50.69 requires that the quality and level of detail of the systematic processes that evaluate the plant for external events during operation are adequate for the categorization of Structures, Systems, and Components.

In the LAR, the licensee proposes to address seismic hazard risk using the alternative seismic approach for seismic Tier-1 plants described in Electric Power Research Institute (EPRI) Report 3002017583, "Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization" (https://www.epri.com/research/products/000000003002017583) and other qualitative considerations. The NRC staff understands that EPRI 3002017583 is an updated version of EPRI 3002012988 that was reviewed in conjunction with its review of the Calvert Cliffs Nuclear Power Plant (CCNPP), Units 1 and 2, LAR for adoption of 10 CFR 50.69 (precedent) dated November 28, 2018 (ADAMS Accession No. ML18333A022). The staff has not reviewed or endorsed EPRI 3002012988 as a topical report for generic use. As such, each licensee needs to perform a plant-specific review for applicability of the Tier-1 alternative seismic approach. The NRC staff reviewed and approved CCNPP's alternative seismic approach, which was based on information for Tier-1 plants included in EPRI 3002012988 and information provided in the supplements to the CCNPP LAR. Information in the supplements to the CCNPP LAR (ADAMS Accession Nos. ML19130A180, ML19200A216, ML19217A143, and ML19183A012) that was used to support the staff's review and approval of that approach is included in the staff's safety evaluation for the CCNPP LAR (ADAMS Accession No. ML19330D909).

The NRC staff notes that the licensee's proposed alternative seismic approach is similar to that reviewed and approved in the CCNPP safety evaluation. However, the licensee's proposed approach is based on information for Tier-1 plants as described in EPRI 3002017583 instead of EPRI 3002012988.

Further, the staff notes that EPRI 3002017583 does not contain all the information in the supplements to the CCNPP LAR that supported the use of EPRI's alternative seismic approach for Tier-1 plants in the CCNPP plant-specific safety evaluation. Therefore, the licensee is requested to address the following:

(a) The licensee cited EPRI report 3002017583 as applicable to their submittal, please submit EPRI report 3002017583 on the docket.

(b) Identify and describe the differences between EPRI 3002017583 and EPRI 3002012988.

(c) Explain whether EPRI 3002017583 includes all the information from the CCNPP LAR supplements that was used to support the staff's review of the alternative seismic approach for Tier-1 plants described in EPRI 3002012988. If any information from the CCNPP LAR supplements are not included in EPRI 3002017583, justify such exclusion for the licensee's proposed alternative seismic approach or indicate where it is addressed in the licensee's application for Farley.

(d) Based on the responses to items (b) and (c), justify why a separate staff review of EPRI 3002017583 for the licensee's proposed alternative seismic approach is not warranted.

to NL-21-0019 SNC Response to NRC RAI E1-2 (e) Identify and justify any differences between the licensee's proposed alternative seismic approach and the NRC staff approval of the precedent documented in the CCNPP safety evaluation, including any Farley-specific considerations.

SNC Response to NRC RAI 1:

(a) The requested EPRI document is provided as Enclosure 2.

(b) The technical criteria in EPRI Report 3002017583 is unchanged from EPRI Report 3002012988. The Product Description at the beginning of EPRI Report 3002017583 states the following:

"This Technical Update incorporates updates submitted to the NRC in an RAI submittal for the Calvert Cliffs 50.69 LAR into the previous version of this report, EPRI 3002012988. Aside from those updates, the technical criteria in this report remains unchanged."

Exelon provided the seismic alternative markups to Report 3002012988 in Attachment 2 of its July 19, 2019 RAI response submittal (ML19200A216).

In addition, EPRI Report 3002017583 incorporated a few minor editorial changes including the following:

1. Figure 1-2 was edited to include EPRI 3002017583 in the list of §50.69 supplemental guidance documents.

2. Figure 2-2, Low Seismic Hazard Site: Typical SSE to GMRS Comparison -

replaced graph with correct graph.

(c) EPRI 3002017583 has incorporated all the information and follow up actions from the CCNPP LAR supplements that was agreed upon by the NRC staffs review of the alternative seismic approach for Tier -1 plants. Therefore, Attachment 2 of ML19200A216 are applicable to Farley since it is using the updated EPRI Document 3002017583, Alternative Approaches for Addressing Seismic Risk in 10CFR 50.69 Risk-Informed Categorization. Farleys applicability to other CCNPP LAR supplements and attachments are addressed below:

to NL-21-0019 SNC Response to NRC RAI E1-3 Table RAI-01-1. Farley Applicability to CCNPP LAR supplements.

Item Applicable to Farley Incorporated into EPRI 3002017583 Basis ML19130A180 CCNPP Supplement 05/10/2019 x

The revisions to the CCNPP LAR, expect areas that were specific to CCNPP, were included throughout Section 3 of the Farley LAR.

ML19183A012 CCNPP Supplement 07/01/2019 RAI 4 a.

x The two paragraphs cited are in Section 3.2.3 of the Farley LAR. The clarification discussed in the CCNPP response would apply to Farley.

RAI 4 b.

x Farley has a peer reviewed Seismic PRA that meets the guidance in RG 1.200. All F&Os were closed through the Appendix X process.

RAI 5

x SSCs credited for screening of external hazards will be evaluated according to the flow chart in NEI 00-04, Figure 5-6. See SNC response to RAI 1(e).

RAI 6

x In accordance with NEI 00-04 and existing SNC fleet procedures, Interfacing functions/SSC will not be categorized and will not be subject to alternative treatment until categorization of all the systems that are supported is complete unless the function/SSC is initially categorized as HSS RAI 8 a.

x For plant Farley, FLEX methodology, equipment, and associated operator actions are discussed in RAI 2.

RAI 8 b.

x For plant Farley, FLEX methodology, equipment, and associated operator actions are discussed in RAI 2.

ML19200A216 CCNPP Supplement 07/19/2019 RAI 1 a.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 1 b.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 to NL-21-0019 SNC Response to NRC RAI E1-4 Table RAI-01-1. Farley Applicability to CCNPP LAR supplements.

Item Applicable to Farley Incorporated into EPRI 3002017583 Basis RAI 1 c.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 1 d.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 1 e.

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583.

RAI 1 f.

x Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583.

RAI 2 a. i.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 2 a. ii.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 2 b. i.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 2 b. ii.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 3 a. i.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 to NL-21-0019 SNC Response to NRC RAI E1-5 Table RAI-01-1. Farley Applicability to CCNPP LAR supplements.

Item Applicable to Farley Incorporated into EPRI 3002017583 Basis RAI 3 a. ii.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 3 b.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 3 c. i.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 3 c. ii.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 3 c. iii.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 3 c. iv.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 3 d. i.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 RAI 3 d. ii.

x x

Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583 to NL-21-0019 SNC Response to NRC RAI E1-6 Table RAI-01-1. Farley Applicability to CCNPP LAR supplements.

Item Applicable to Farley Incorporated into EPRI 3002017583 Basis RAI 7 a.

x The PRA key assumptions and sources of uncertainty are determined consistent with the definitions in RG 1.200. The Disposition of Key Assumptions/ Sources of Uncertainty are discussed in Attachment 6 of the June 18, 2020 Farley application.

RAI 7 b.

Not applicable to Farley. No new key assumptions and sources of uncertainty have been identified for the application.

RAI 7 c.

x The Disposition of Key Assumptions/ Sources of Uncertainty are discussed in Attachment 6 of the June 18, 2020 Farley application.

ML19217A143 CCNPP Supplement 08/05/2019 RAI 3 c. iv. Revised x

x This supplement revised part of the response to RAI 3 c. iv. Farley will be using EPRI 3002017583 and this response addresses the clarification requested by the NRC for the case studies within EPRI 3002017583.

to NL-21-0019 SNC Response to NRC RAI E1-7 (d) A separate staff review of EPRI 3002017583 for the Farley proposed alternative seismic approach is not warranted based on the following:

i.

Other than the incorporation of updates submitted to the NRC in an RAI submittal for the CCNPP 50.69 LAR, the technical criteria from EPRI 3002012988 is unchanged, as described in response 1b; ii.

SNC confirmation that EPRI 3002017583 has incorporated the agreed upon information and follow up actions from the CCNPP LAR supplements from NRC staffs review of the alternative seismic approach for Tier 1 as described in response 1c; and iii.

Review of CCNPP LAR supplements for their applicability to Farley in response 1c.

(e) In review of the CCNPP SE, two differences were identified from the proposed alternative seismic approach documented in the Farley LAR. As discussed below, both of these differences will be incorporated into the categorization process.

1. In the section Monitoring of Inputs to and Outcome of Proposed Alternative Seismic Approach of the CCNPP SE, the configuration control program for CCNPP had been updated to include a checklist of configuration activities to recognize those systems that have been categorized in accordance with 10 CFR 50.69, to ensure that any physical change to the plant or change to plant documents is evaluated prior to implementing those changes. This checklist is the same as what is included in Section 3.5 of the Farley LAR except for Review of impact to seismic loading and SSE seismic requirements, as well as the method of combining seismic components. This checklist item will also be included in the SNC configuration control program.

2. Section 3.5.3.2 of the CCNPP SE discusses categorization assessment of other external hazard, NEI 00-04 requires that, as part of the external hazard screening, an evaluation be conducted to determine if there are components that participate in screened scenarios and whose failure would result in an unscreened scenario and that such SSCs are required to be high safety-significant in the categorization process. The evaluation is not mentioned in the Farley LAR. This evaluation will also be included in the SNC categorization assessment of other external hazard risk. Consistent with the flow chart in Figure 5-6 in Section 5.4 of NEI 00-04, these components would be considered high safety-significant (HSS).

to NL-21-0019 SNC Response to NRC RAI E1-8 NRC RAI 2:

The NRC memorandum dated May 30, 2017, "Assessment of the Nuclear Energy Institute 16-06, 'Crediting Mitigating Strategies in Risk-Informed Decision Making,' Guidance for Risk-Informed Changes to Plants Licensing Basis" (ADAMS Accession No. ML17031A269), provides the NRC's staff assessment of challenges to incorporating FLEX equipment and strategies into a PRA model in support of risk-informed decision making in accordance with the guidance of RG 1.200, Revision 2.

Section 3.3 of the LAR mentions the PRA modeling of FLEX equipment and FLEX operator actions. More information is needed for the NRC staff to determine the acceptability of incorporation of FLEX equipment into the PRA models. Please provide the following information for the internal events and internal flooding PRAs, as appropriate:

(a) A discussion detailing the extent of incorporation, i.e., summarizing the supplemental equipment and compensatory actions, including FLEX strategies, that have been credited quantitatively for each of the PRA models used to support this application.

(b) A discussion detailing the methodology used to assess the failure probabilities of any modeled equipment credited in the licensee's mitigating strategies (i.e., FLEX). The discussion should include a justification of the rationale for parameter values, and how the uncertainties associated with the parameter values are considered in the categorization process in accordance with ASME/ANS RA-Sa-2009, as endorsed by RG 1.200 (e.g., supporting requirements for HLR-DA-D).

(c) A discussion detailing the methodology used to assess operator actions related to FLEX equipment and the licensee personnel that perform these actions. The discussion should include:

i.

A summary of how the licensee evaluated the impact of the plant-specific human error probabilities and associated scenario-specific performance shaping factors listed in (a)-(j) of supporting requirement HR-G3 of ASME/ANS RA-Sa-2009, as endorsed by RG 1.200.

ii.

Whether maintenance procedures for the portable equipment were reviewed for possible pre-initiator human failures that renders the equipment unavailable during an event, and whether the probabilities of the pre-initiator human failure events were assessed as described in HLR-HR-D of ASME/ANS RA-Sa-2009, as endorsed by RG 1.200.

iii.

If the licensee's procedures governing the initiation or entry into mitigating strategies are ambiguous, vague, or not explicit, a discussion detailing the technical basis for probability of failure to initiate mitigating strategies.

(d) ASME/ANS RA-Sa-2009 defines PRA upgrade as the incorporation into a PRA model of a new methodology or significant changes in scope or capability that impact the significant accident sequences or the significant accident progression sequences. Section 1-5 of Part 1 of ASME/ANS RA-Sa-2009 states that upgrades of a PRA shall receive a peer review in accordance with the requirements specified in the peer review section of each respective part of this standard.

to NL-21-0019 SNC Response to NRC RAI E1-9

i.

Provide an evaluation of the model changes associated with incorporating mitigating strategies, which demonstrates that none of the following criteria is satisfied: (1) use of new methodology, (2) change in scope that impacts the significant accident sequences or the significant accident progression sequences, (3) change in capability that impacts the significant accident sequences or the significant accident progression sequences, OR ii.

Propose a mechanism to ensure that a focused-scope peer review is performed on the model changes associated with incorporating mitigating strategies, and associated F&Os are resolved to Capability Category II prior to implementation of the 10 CFR 50.69 categorization program.

(e) OR, as an alternative to Parts (a), (b), (c), and (d), above: Remove credit for FLEX equipment in the PRA used to support this LAR, and provide updated risk results (i.e.,

LAR Attachment 2) that does not credit FLEX equipment and actions.

to NL-21-0019 SNC Response to NRC RAI E1-10 SNC Response to NRC RAI 2 (a) As part of the plant modifications associated with FLEX implementation, certain portable FLEX equipment is stored in the FLEX storage dome and are installed in the plant. The plant procedures have also been revised to include these plant modifications. The FLEX operator actions, and equipment are credited in the Farley Internal Events, Internal Flooding, and Fire PRA models, which are used in 10 CFR 50.69 categorization. A summary of credited FLEX strategies, supplemental equipment, and compensatory actions associated with extended loss of offsite power conditions are shown in Table RAI-02-1.

Table RAI-02-1. Credited FLEX Strategy, Equipment, and Actions in PRA Credited Action Flex Strategy -

Modeled Supplemental Equipment Compensatory Actions Stage portable battery powered lighting for use in MCR after load shed x

x x

Minimize battery load to extend operations of the DC and Vital AC busses x

x Open doors for ventilation of the battery and DC equipment rooms x

x Manually control the TDAFWP x

Opening of the MCR access doors for sufficient ventilation x

x Stage and connect 600V Flex DG to DC bus battery chargers x

x x

Deploy portable fans for switchgear rooms for proper ventilation x

x x

Stage and connect SG Flex pump in the event the TDAFWP fails x

x x

Transfer makeup water from RMWST to the CST using the SG Flex pump before CST inventory is exhausted.

x x

Install portable fans in MCR to maintain an acceptable temperature x

x x

to NL-21-0019 SNC Response to NRC RAI E1-11 (b) Neither plant-specific data nor generic industry parameter estimates are available for the portable FLEX diesel generators, pumps, and fans; therefore, use of the Farley Bayesian updated data for diesel generators and diesel HVAC fans are used for FLEX diesel generators and fans. Use of generic industry parameter estimates from NUREG/CR-6928 are used for the FLEX pumps.

The portable FLEX diesel generators, pumps, and fans are not like other installed plant equipment, thus an additional factor of two is applied to the unreliability failure probabilities. This escalation is a reasonable approximation of the unreliability of portable FLEX equipment according to the guidance in NEI 12-06 until industry data is published.

The uncertainties associated with the FLEX equipment data values are based upon the uncertainty parameters from the Farley Bayesian updated data (diesel generators and fans) and generic industry data (pumps) and are in accordance with the ASME/ANS PRA Standard. Use of these values should provide a reasonable approximation of the reliability of the FLEX equipment until industry-approved data becomes available for FLEX equipment.

A sensitivity analysis was performed to assess the impact FLEX equipment probability has on CDF and LERF. The FLEX equipment failure probabilities were increased by a factor of five. A factor of 3 means that the resulting sensitivity is larger than the base case 95th percentile. Table RAI-02-2 summarizes the results from the sensitivity. The sensitivity shows there is a small change to CDF and LERF, and the dominant failures of FLEX strategies in the PRA model are HRA related. Since there is no significant impact on CDF or LERF from the parametric uncertainty, there is no significant impact on the 50.69 program risk assessment.

Table RAI-02-2. FLEX Equipment Failure Rate Sensitivity Unit 1 Delta Unit 2 Delta Internal Events CDF 7.0E-08 2.3E-08 LERF 1.4E-10 4.5E-11 Internal Flood CDF 0.0E+00 0.0E+00 LERF 0.0E+00 0.0E+00 Fire CDF 1.5E-06 1.5E-08 LERF 3.3E-09 0.0E+00 Total Delta CDF 1.5E-06 3.8E-08 Total Delta LERF 3.4E-09 4.5E-11 to NL-21-0019 SNC Response to NRC RAI E1-12 (c)

i.

The impacts of the performance shaping factors on the HEPs for the operator actions associated with the FLEX modeling were evaluated in HRA Post-Initiators

& Dependency Analysis and are listed in Table RAI-02-3. The aggregate HEP for the FLEX/ELAP actions is approximately 1.0E-1, which is consistent with the NEI 16-06 (Reference F.13) screening probabilities for FLEX strategies and considered to represent a reasonable approximation of the overall failure probability of a complex mitigation strategy employing portable equipment in potentially challenging conditions.

to NL-21-0019 SNC Response to NRC RAI E1-13 Table RAI-02-3. FLEX Credited Actions Credited Action PSF Impact Basis PSF Impact Stage portable battery powered lighting for use in MCR after load shed For a case in which the determination that AC power will not be recovered within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of plant trip has been made by the procedurally directed time frame from plant trip, the operators would potentially be finished with MCR light de-energization with plenty of time to spare from plant trip. This limited amount of time required to finish the MCR light de-energization would allow them to completely re-perform the MCR light de-energization action, if necessary (based on the slowest recorded validation time). With one operator per unit, this is not a high workload task.

The operators would be working in SBO conditions in which emergency and/or portable lighting would be required.

Negative Minimize battery load to extend operations of the DC and Vital AC busses For a case in which the determination that AC power will not be recovered within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of plant trip has been made by the procedurally directed time frame from plant trip, the operators would potentially be finished with load within minimal time from plant trip. This would allow them to completely re-perform the load shed action, if necessary (based on the slowest recorded validation time). With one SO per unit, this is not a high workload task.

The SOs would be working in SBO conditions in which emergency and/or portable lighting would be required.

Negative to NL-21-0019 SNC Response to NRC RAI E1-14 Table RAI-02-3. FLEX Credited Actions Credited Action PSF Impact Basis PSF Impact Manually control the TDAFWP For this case, the plant response is not as expected in that there is an extended SBO, but the FLEX strategies are available to mitigate these conditions and the crews have trained to perform them. While the ELAP scenario is undesirable, load shed actions would have been completed successfully or be in progress, SG level would initially be maintained by TDAFW, and adequate time would be available for the SOs to perform the action. There is no indication that the plant is heading toward core damage.

The crew would have adequate time to begin the process of establishing local control of the TDAFW pump, though there are actions to which the responsible SOs would be assigned prior to taking local control of the TDAFW pump. However, those tasks are expected to be complete with adequate time to spare. This does not correlate to conditions in which the crew would be at the limit of what they could achieve in the time that is available. "Low" workload is assigned.

Due to loss of power, Auxiliary Building elevators and HVAC will be unavailable.

Flashlights and headlamps will be available for personnel. Due to heat in the area around the TDAFW pump, the operator may move to a cooler area and make periodic checks on the pump. Continuous monitoring is not required. "Negative" PSFs are considered to always be applicable.

Negative Stage and connect 600V Flex DG to DC bus battery chargers Opening of the MCR access doors for sufficient ventilation For this case, the plant response is not as expected in that there is an extended SBO, but the FLEX strategies are available to mitigate these conditions and the crews have trained to perform them. Once ELAP is declared, this is the expected response. While the ELAP scenario is undesirable, the load shed action would have been completed successfully. The TDAFW failure is an additional complication, but the time available for the alignment of the 600V FLEX D/G is still the same and the response plan for the generator crew would remain the same. If a serious problem occurred with the pump deployment task that required the crew to help with that task, it would cause a disruption, but this is not assumed to happen.

There is an abundant amount of recovery time available for this action even with debris removal required. The workload is not high.

The lineup includes outdoor activity and for SBO cases, adverse weather is likely (adverse conditions assumed to exist).

Moderate to NL-21-0019 SNC Response to NRC RAI E1-15 Table RAI-02-3. FLEX Credited Actions Credited Action PSF Impact Basis PSF Impact Deploy portable fans for switchgear rooms for proper ventilation Stage and connect 600V Flex DG to DC bus battery chargers For this case, the plant response is not as expected in that there is an extended SBO, but the FLEX strategies are available to mitigate these conditions and the crews have trained to perform them. Once ELAP conditions are identified, this is the expected response. While the ELAP scenario is undesirable, the load shed action would have been completed successfully, SG level would initially be being maintained by TDAFW, and adequate time (many hours) would be available for the alignment of the portable fans for DC Switchgear and Battery Charger Room cooling. However, for the PRA scenarios, TDAFW pump fails as early as 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from plant trip, which may be before or during the time when the crew is staging and connecting the portable fans. The TDAFW failure is an additional complication, but the time available for the alignment of the fans is still the same and the response plan for the crew would remain the same. If a serious problem occurred with the pump deployment task that required the crew to help with that task, it would cause a disruption, but this is not assumed to happen.

There are several hours available to perform the initial work completing the initiation of the fans after 600V FLEX DG start was described as not challenging by plant staff.

Other than obtaining the ductwork from the FLEX trailer and transport vehicle, the work is performed indoors. If, for some reason, the work is completed near the end of the allow time window, temperatures would be around 120 degrees, which correlates to a "negative" condition. In addition, the work would be performed in emergency lighting conditions, which are not optimal.

Moderate to NL-21-0019 SNC Response to NRC RAI E1-16 Table RAI-02-3. FLEX Credited Actions Credited Action PSF Impact Basis PSF Impact Stage and connect SG Flex pump in the event the TDAFWP fails Deploy portable fans for switchgear rooms for proper ventilation For this case, the plant response is not as expected in that there is an extended SBO, but the FLEX strategies are available to mitigate these conditions and the crews have trained to perform them. Once the FLEX strategies are initiated, this is the expected response. While the ELAP scenario is undesirable, the load shed action would have been completed successfully, SG level would initially be being maintained by TDAFW, and adequate time (many hours) would be available for the alignment of the SG FLEX Pump to help maintain the plant in a stable condition. However, for the PRA scenarios, TDAFW pump fails as early as 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from plant trip, which may be before or during the time when the crew is staging and connecting the SG FLEX Pump. Loss of the only available SG makeup pump would put pressure on the crew members because unless they succeed, core damage would occur unless AC power is recovered. There is substantial time available to complete the SG FLEX Pump alignment, but the crew members would not have a clear indication of how much time is available to them for the alignment (though it is known for the PRA evaluation). This is considered to be a condition that is not an expected plant response.

High Initiate SG Flex Pump makeup after TDAFW Pump failure stage and connect SG Flex pump in the event the TDAFWP fails For this case, the plant response is not as expected in that there is an extended SBO, but the FLEX strategies are available to mitigate these conditions and the crews have trained to perform them. While the ELAP scenario is undesirable, load shed actions would have been completed successfully, SG level would have been maintained by TDAFW for 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, and adequate time (several hours) would be available for the initiation of the SG FLEX Pump to help maintain the plant in a stable condition after completion of the SG FLEX pump staging/connection action. For these reasons, this is not considered to be a high stress action, particularly because of the long period of time over which the action occurs and the significant time margin that is available to the crew.

The crew would have several hours to initiate SG FLEX pump makeup, which does not correlate to conditions in which the crew would be at the limit of what they could achieve in the time that is available. "Low" workload is assigned.

Work in ELAP conditions may require the use of portable lighting, working in difficult positions in the main steam valve room, and would likely be performed and in poor weather conditions related to the loss of offsite power. "Negative" PSFs are considered to always be applicable.

Moderate to NL-21-0019 SNC Response to NRC RAI E1-17 ii.

Farleys assessment for pre-initiator human failure maintenance events is not possible to cause an event since FLEX equipment is not aligned for operation but stored in FLEX dome during normal operation. Miscalibration of FLEX equipment or errors during maintenance of FLEX equipment do not need to be separately modeled since any miscalibration which fail FLEX equipment when demanded is already accounted for FLEX equipment failure probabilities. These probabilities are estimated based on number of demands and run hours and number of failures. Miscalibration of equipment often causes auto operation signals for normal components. However, FLEX equipment is manually started and aligned only when they are deployed, therefore miscalibration error is not applicable to FLEX equipment.

iii.

The modeling used to represent the failure to initiate mitigating strategies was accomplished by using a screening HEP consisting of the operators failing to identify ELAP conditions and enter FLEX strategies. This modeling and quantification is based on the IDHEAS Delay Implementation event tree from EPRI Report 3002013018, Human Reliability Analysis (HRA) for Diverse and Flexible Mitigation Strategies (FLEX) and Use of Portable Equipment.

(d)

i.

See response of 2(d)ii.

ii.

A focus-scope peer review was performed in December 2019 on FLEX modeling for Plant Farley Internal Events, Internal Flood, and Fire. The scope consisted of a review of 116 relevant SRs contained in Sections 2, 3, and 4 of the ASME/ANS PRA Standard. There were no finding level F&Os to be resolved. All SRs were met at Capability Category II or higher.

(e) Not Applicable to NL-21-0019 SNC Response to NRC RAI E1-18 NRC RAI 3:

RG 1.174, Revision 3, "An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis," provides risk acceptance criteria.

in terms of the change in risk in combination with either total core damage frequency or large early release frequency.

RG 1.174 and Section 6.4 of NUREG 1855, Revision 1, for a Capability Category II risk evaluation, indicate that the mean values of the risk metrics (total and incremental values) need to be compared with risk acceptance guidelines. The mean values referred to are the means of the probability distributions that result from the propagation of the uncertainties on the PRA input parameters and model uncertainties explicitly reelected in the PRA models. In general, the point estimate CDF and LERF obtained by quantification of the cutset probabilities using mean values for each basic event probability does not produce a true mean of the CDF/LERF. Under certain circumstances, a formal propagation of uncertainty may not be required if it can be demonstrated that the state-of-knowledge correlation (SOKC) is unimportant (i.e., the risk results are well below the acceptance guidelines).

Section 8 of NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline, requires a cumulative sensitivity study to evaluate the potential impact on CDF and LERF based on a postulated reduction in reliability due to the special treatment of selected SSCs. The guidance states that the results of this study should be compared to the risk acceptance guidelines of RG 1.174 as a measure of acceptability.

LAR Attachment 2 presents estimates of the total CDF and LERF based on the internal events (including flooding) and fire risk. NRC staff notes that for FNP, the total CDF of 8.4E-05 per year begins to approach the RG 1.174, Revision 3, threshold of 1E-04 per year for total CDF without considering the risk increase due to SOKC.

Please address the following:

(a) Demonstrate that FNP's total CDF and LERF mean values meet the RG 1.174 risk acceptance guidelines.

(b) As an alternative to Part (a), provide justification that the FNP risk values represent an acceptable level of risk to public safety.

(c) Clarify, with regards to the NEI 00-04 Section 8 sensitivity study, that the FNP calculation will use the mean risk values of each PRA modeled hazard group. Include in this discussion what steps FNP will perform in the case the sensitivity results exceed the RG 1.174 acceptance guidelines.

(d) Alternatively to Part (c), propose a mechanism that ensures the NEI 00-04 Section 8 cumulative sensitivity study results is in conformance with the RG 1.174 risk acceptance guidelines when the internal events, internal flooding, and fire PRA mean values are used in the study.

to NL-21-0019 SNC Response to NRC RAI E1-19 SNC Response to NRC RAI 3 (a) Tables RAI-03-1 and RAI-03-2 demonstrates the FNP total CDF and LERF mean values meet RG 1.174 risk acceptance guidelines.

RAI-03-1. FNP CDF and LERF Mean Values Unit Hazard CDF/LERF Mean Value 1

IE CDF 2.9E-06 IE LERF 1.9E-08 IF CDF 4.2E-06 IF LERF 1.8E-08 F

CDF 7.7E-05 F

LERF 2.7E-06 S

CDF 8.9E-07 S

LERF 7.4E-08 2

IE CDF 3.0E-06 IE LERF 2.0E-08 IF CDF 4.0E-06 IF LERF 1.7E-08 F

CDF 7.7E-05 F

LERF 5.2E-06 S

CDF 8.9E-07 S

LERF 7.6E-08 Note: IE-Internal Events, IF-Internal Flood, F-Fire, S-Seismic RAI-03-2. Total FNP CDF and LERF Mean Values Unit 1 Total Unit 2 Total CDF 8.4E-05 8.5E-05 LERF 2.8E-06 5.3E-06 (b) Not applicable.

(c) The FNP calculation to meet the requirements of the sensitivity study described in NEI 00-04, Section 8, will use mean values for comparison to the RG 1.174 acceptance guidelines. If the sensitivity results exceed the RG 1.174 guidelines, FNP will follow the NEI 00-04 guidance by reducing the FV and RAW threshold values used for categorization. The NEI 00-04 HSS thresholds will be lowered until such time as the RG 1.174 values can again be met. If previously categorized systems are impacted, the existing SSC categorization and treatment process will be followed.

(d) Not applicable.

I I

Joseph M. Farley Nuclear Plant - Units 1 and 2 Response to Request for Additional Information Regarding Application to Adopt 10 CFR 50.69, "Risk-informed categorization and treatment of structures, systems and components for nuclear power reactors" EPRI Report 3002017583

Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization 3002017583 EP121I ELECTRIC POWER RESEARCH INSTITUTE

EPRI Project Manager J. Richards All or a portion of the requirements of the EPRI Nuclear Quality Assurance Program apply to this product.

ELECTRIC POWER RESEARCH INSTITUTE 3420 Hillview Avenue, Palo Alto, California 94304-10412, Palo Alto, California 94303-Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization 3002017583 Technical Update, February 2020 YES 1338

• PO Box 0813

• USA 800.313.3774

• 650.855.2121

• askepri@epri.com

• www.epri.com

DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITIES THIS DOCUMENT WAS PR S AN ACCOUNT OF WORK SPONSORED OR COSPON TRIC POWER RESEARCH INSTITUTE, INC. (EPRI). NEITHER WHATSOEVER, EXPRESS OR IMPLIED, (I)

WITH RESPECT T ORMATION, APPARATUS, METHOD, PROCESS, OR SIMILAR ITEM DISCLOSED IN THIS DOCUMENT, FOR A PARTICULAR PURPOSE, OR (II) THAT SUCH USE DOES NOT INF INTE ELLECTUAL HAT THIS DOCUMENT IS CIRCUMSTANCE; OR Q

I REPRESENTATIVE SELECTION OR USE OF INFORMATION, APPARATUS, METHOD, PROCESS, OR SIMILAR ITEM DISCLOSED IN THIS DOCUMENT.

REFERENCE HEREIN TO IAL PRODUCT, PROCESS ITS TRADE NAME, TRADEMARK, MANUFACTURER, OR OTHERWISE, DOES ITS ENDORSEMENT, RECOMMENDATION, OR FAVO ZATION, UNDER CONTRACT TO EPRI, PREPARED THIS REP Simpson Gumpertz & Heger Inc THE TECHNICAL CONTENTS OF THIS PRODUCT WERE NOT PREPARED IN ACCORDANCE WITH FILLS THE REQUIREMEN DUCT IS NOT IREMENTS OF 10 CFR PART 21.

This is an EPRI Technical Update report. A Technical Update report is intended as an informal report of continuing research, a meeting, or a topical study. It is not a final EPRI technical report.

NOTE For further information about EPRI, call the EPRI Customer Assistance Center at 800.313.3774 or e-Copyright © 2020 Electric Power Research Institute, Inc. All rights reserved.

EPARED BY THE ORGANIZATION NAMED BELOW A SORED BY THE ELEC EPRI, ANY MEMBER OF EPRI, ANY COSPONSOR, THE ORGANIZATION BELOW, NOR ANY PERSON ACTING ON BEHALF OF ANY OF THEM:

(A) MAKES ANY WARRANTY OR REPRESENTATION 0 THE USE OF ANY INF INCLUDING MERCHANTABILITY AND FITNESS RINGE ON OR RFERE WITH PRIVATELY OWNED RIGHTS, INCLUDING ANY PARTY'S INT PROPERTY, OR (Ill) T SUITABLE TO ANY PARTICULAR USER'S (B) ASSUMES RESPONSIBILITY FOR ANY DAMAGES OR OTHER LIABILITY WHATSOEVER (INCLUDING ANY CONSE UENTIAL DAMAGES, EVEN IF EPRI OR ANY EPR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES) RESULTING FROM YOUR THIS DOCUMENT OR ANY ANY SPECIFIC COMMERC CONSTITUTE OR IMPLY THE FOLLOWING ORGANI THE EPRI QUALITY PROGRAM MANUAL THAT FUL APPENDIX B. THIS PRO SUBJECT TO THE REQU mail askepri@epri.com.

, OR SERVICE BY NOT NECESSARILY RING BYEPRI.

ORT:

TS OF 10 CFR 50, Electric Power Research Institute, EPRI, and TOGETHER... SHAPING THE FUTURE OF ELECTRICITY are registered service marks of the Electric Power Research Institute, Inc.

This publication is a corporate document that should be cited in the literature in the following manner:

Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization. EPRI, Palo Alto, CA: 2020. 3002017583.

iii ACKNOWLEDGMENTS The following organization, under contract to the Electric Power Research Institute (EPRI),

prepared this report:

Simpson Gumpertz & Heger Inc.

4695 MacArthur Court, Suite 500 Newport Beach, CA 92660 Principal Investigator G. Hardy This report describes research sponsored by EPRI.

EPRI gratefully acknowledges the contributions of the following individuals and their companies who supported development of this report.

Parthasarathy Chandran, Southern Company Thomas John, Dominion Energy Jacob Johnson, Tennessee Valley Authority Jon Kapitz, Nuclear Energy Institute Eugene Kelly, Exelon Generation Stephen Kimbrough, Duke Energy Greg Krueger, Nuclear Energy Institute Allen Moldenhauer, Dominion Energy Barry Sloane, JENSEN HUGHES Philip Tarpinian, Exelon Generation Charles Young, JENSEN HUGHES Joe Vasquez, Dominion Energy William Webster, Dominion Energy

v PRODUCT DESCRIPTION The U. S. Nuclear Regulatory Commission (NRC) amended its regulations to provide an alternative approach for establishing the requirements for treatment of structures, systems, and components (SSCs) for nuclear power reactors using a risk-informed method of categorizing SSCs according to their safety significance. The NRCs 10 CFR 50.69 process allows a plant to categorize the safety significance of its SSCs using a robust categorization process defined in Nuclear Energy Institute (NEI) 00-04, 10 CFR 50.69 SSC Categorization Guideline, as endorsed by the NRC in Regulatory Guide 1.201. The risk-informed categorization process helps focus attention on SSCs that are the most important to plant safety while allowing increased operational flexibility for SSCs that are less important to plant safety.

Background

Seismic risks are one of the screening criteria evaluated in the categorization process specified in NEI 00-04. Seismic risks can be evaluated using a seismic probabilistic risk assessment (Seismic PRA or SPRA) or a seismic margin assessment (SMA) if an SPRA is not available.

Alternatively, they can be screened out if the seismic core damage frequency (SCDF) and seismic large early release frequency (SLERF) are very small compared to the full power internal events (FPIE) PRA core damage frequency and large early-release frequency.

Some plants do not have an acceptable SPRA or SMA and cannot screen out of seismic considerations. Therefore, cost-effective alternatives for accounting for the insights of seismic risks in the 50.69 categorization process must be considered.

This Technical Update incorporates updates submitted to the NRC in an RAI submittal for the Calvert Cliffs 50.69 LAR into the previous version of this report, EPRI 3002012988. Aside from those updates, the technical criteria in this report remains unchanged.

Objectives To develop alternative approaches for plants to provide the necessary seismic risk insights within the 50.69 categorization process.

Approach Trial 50.69 categorization evaluations are performed at four plants with SPRAs and high seismic hazards compared to their seismic design bases to determine the seismic-related categorization insights. Those insights are compared with categorization insights at the same plants using their FPIE PRAs and fire PRAs if available to determine the degree to which the seismic insights produce unique categorization insights.

The results of the trial cases are used to develop a risk-informed graded approach based on the degree to which the seismic hazard exceeds the seismic design basis ground motions and the degree to which unique seismic categorization insights are likely.

vi The treatment of potentially seismically correlated failures in SPRAs and identification of seismic interactions can lead to unique 50.69 categorization insights. Therefore, a process is developed to identify the plant conditions that would be treated as seismically correlated failures or interaction failures in an SPRA if one were available. For those conditions, a sensitivity study is recommended using the FPIE PRA to determine the impact of treating such seismic failures as common -cause events. Using this process, the necessary seismic risk insights can be identified for the 50.69 categorization process.

Results Detailed analyses of seismic risks show very few insights to the 50.69 categorization results that uniquely identify SSCs as high-safety-significant. The primary unique categorization insights that would result from treatment of seismic-correlated failures in SPRAs can be derived using a process described in the report. A three-tiered, graded evaluation process is developed for considering seismic risk insights in the 50.69 categorization process.

Keywords 10 CFR 50.69 Risk-informed categorization Seismic risk

EXECUTIVE

SUMMARY

vii Deliverable Number: 3002017583 Product Type: Technical Report Product

Title:

Alternative Approaches for Addressing Seismic Risk in 10 CFR 50.69 Risk-Informed Categorization PRIMARY AUDIENCE: Individuals SECONDARY AUDIENCE: Individuals involved KEY RESEARCH QUESTION categorization without requiring development of a new seismic probab and moderate seismic hazard sites?

RESEARCH OVERVIEW ization process. These studies were performed at plants with high seismic hazards relative to their design basis and that had developed new SPRAs. The results

-safety-significant ismic conditions were generally associated with correlated

-tiered graded approach (low, medium, and high) was developed for considering seismi study process was developed to derive seismic-(PRA) and common-cause techniques.

KEY FINDINGS At high-seismic-hazard plantswhere the ground motion response spectrum significantly

reasons (Section 3).

At high-seismic-hazard plants, the assumption of correlated seismic equipment failures can lead to hts (Section 3).

other non-entify the HSS structures, systems, and components necessary to seismic challenges.

on the results (Section 2).

A process is defined to identify conditions where seismically correlated component failures and seismic interactions would be modeled in an SPRA with a sensitivity study to determine the categorization impacts of those conditions using an internal events PRA and common-cause analysis techniques (Section 2.3.1 and App EPl21 1 E LEC TR IC POWER RESEA CH INSTITUTE developing License Amendment Requests to implement 10 CFR 50.69 in performing categorization using the 10 CFR 50.69 process Can an alternative process be used to provide the necessary seismic risk insights to perform 10 CFR 50.69 ilistic risk assessment (SPRA) for low Sensitivity studies were performed at four nuclear plants to investigate the degree to which seismic risk insights uniquely contributed to the 10 CFR 50.69 categor showed that few if any seismic risk insights uniquely caused an SSC to be classified as high (HSS) under 50.69 criteria and that the unique se seismic fragilities. Given these results, a three c risks in the 10 CFR 50.69 process. In addition, a sensitivity correlated insights using an internal events probabilistic risk assessment exceeds the safe shutdown earthquake very few SSCs would be categorized as HSS solely for seismic risk unique 50.69 categorization insig Risk insights from internal events PRAs, combined with the insights from a fire PRA (if available) and PRA aspects of the 50.69 categorization process, adequately id address seismic risks, with the exception of a few unique A graded approach based on the degree to which the ground motion response spectrum (GMRS) exceeds the safe shutdown earthquake (SSE) can be used to appropriately focus resources plants where seismic risk insights are more likely to uniquely contribute to the 50.69 categorization endices A and B).

EXECUTIVE

SUMMARY

Together...Shaping the Future of Electricity Electric Power Research Institute 3420 Hillview Avenue, Palo Alto, California 94304-

-0813 USA 800.313.3774 *

• www.epri.com

© 2020 Electric Power Research Institute (EPRI), Inc. All rights reserved. Electric Power Research Institute, EPRI, and WHY THIS MATTERS Some plants do not have the tools identified in Nuclear Energy Institute (NEI) 00-04 to consider seismic insights in the categorization process. This report provides a graded, cost-effective, alternative process to appropriately consider seismic insights without requiring development of new SPRAs at low and moderate are directly applicable to that process. Any plant with a low or medium seismic hazard would be eligible to apply this process.

HOW TO APPLY RESULTS seismic hazard tier. Low-seismic-hazard plants should follow the process outlined in Section 2.2, medium-seismic-hazard plants should follow the process in Section 2.3, and high-seismic-hazard plants should follow the process in Section 2.4.

LEARNING AND ENGAGEMENT OPPORTUNITIES 9-related topics are being held. Contact Pat ORegan for additional information.

EPRI CONTACTS: John and Pat ORegan, Technical PROGRAM:

IMPLEMENTATION CATEGORY: Reference EPl21 1 E LEC TR IC POWER RESEA CH INSTITUTE seismic hazard sites. The technical basis for the methods are specific to the 50.69 categorization process and Plants should compare their GMRS with their SSE and determine if they fall in the low, medium, or high Periodic workshops on 50.6 Richards, Technical Executive, jrichards@epri.com Executive, poregan@epri.com Risk and Safety Management, P41.07.01 1338

• PO Box 10412, Palo Alto, California 94303 650.855.2121 askepri@epri.com TOGETHER... SHAPING THE FUTURE OF ELECTRICITY are registered service marks of the Electric Power Research Institute, Inc.

ix ACRONYMS AND ABBREVIATIONS AC alternating current ACUBE Advanced Cutset Upper Bound Estimator AFW auxiliary feedwater AFWPH auxiliary feedwater pumphouse ANS American Nuclear Society ANSI American National Standards Institute AOV air-operated valve ASME American Society of Mechanical Engineers BDD binary decision diagram BPVC Boiler and Pressure Vessel Code BWR boiling water reactor CAFTA Computer Aided Fault Tree Analysis System CB circuit breaker CCDP conditional core damage probability CCF common cause failure CCW component cooling water CDF core damage frequency CIV containment isolation valve CLERF conditional large, early release probability CR control rod CRM configuration risk management CST condensate storage tank DG diesel generator DID defense in depth EDG emergency diesel generator ELAP extended loss of alternating current power EPRI Electric Power Research Institute F&O fact and observation FIVE Fire-Induced Vulnerability Evaluation

x FLEX diverse and flexible mitigation strategies F-MCUB factor-minimum cutset upper bound FPIE full power internal events FPRA fire probabilistic risk assessment FTREX Fault Tree Reliability Evaluation eXpert F-V Fussell-Vesely GE General Electric GIP generic implementation procedure GMRS ground motion response spectrum HCLPF high confidence of low probability of failure HCU hydraulic control unit HHSI high head safety injection HPCI high pressure coolant injection HSS high safety significant HVAC heating, ventilation, and air condition HX heat exchanger IDP integrated decision-making panel IE internal events IEEE The Institute of Electrical and Electronics Engineers IFV Integrated Fussell-Vesely IPEEE Individual Plant Examination of External Events IRAW Integrated Risk Achievement Worth ISRS in-structure response spectra LERF large early release frequency LHSI low head safety injection LOCA loss of coolant accident LOOP loss of off-site power LSS low safety significant LUHS loss of normal access to the ultimate heat sink MCC motor control center MCR main control room MOV motor-operated valve MSA mitigation strategy assessment MWe mega-watt, electric MWt mega-watt, thermal NEI Nuclear Energy Institute

xi NPP nuclear power plant NRC Nuclear Regulatory Commission NSCW nuclear service cooling water NSSS nuclear steam supply system NTTF Near Term Task Force OOS out of service PGA peak ground acceleration PRA probabilistic risk assessment PSHA probabilistic seismic hazard analysis PWR pressurized water reactor RAW risk achievement worth RCIC reactor core isolation cooling RCP reactor coolant pump RCS reactor coolant system RG Regulatory Guide RISC risk informed safety class SBO station blackout SCDF seismic-induced core damage frequency SEL seismic equipment list SF severity factor SFP spent fuel pool SGIG safety grade instrument gas SI safety injection SLERF seismic-induced large early release frequency SLOCA seismic-induced loss of coolant accident SMA seismic margin assessment SPCL success path component list SPID screening, prioritization and implementation details SPRA seismic probabilistic risk assessment SQUG Seismic Qualification Utility Group SSC structures, systems and components SSD safe shutdown SSE safe shutdown earthquake SSEL safe shutdown equipment list

xii UHRS uniform hazard response spectra USI Unresolved Safety Issue VAC volts alternating current VDC volts direct current

xiii CONTENTS 1 BACKGROUND...................................................................................................................... 1-1 1.1 Seismic Evaluations at Nuclear Power Plants................................................................. 1-1 1.1.1 Unresolved Safety Issue A-

................................................................................. 1-2

..................................................... 1-3

........................................................................... 1-4

......................................................... 1-4 1.1.3.2 NTTF Recommendation 2.1 Seismic Evaluations........................................... 1-4 1.1.3.3 Mitigation Strategy Assessment....................................................................... 1-1.1.4 Insights from Past Seismic Programs and Studies.................................................. 1-

............................................................................ 1-7

............................................ 1-13 2 PROPOSED APPROACH...................................................................................................... 2-1 2.1 Overview of Approaches................................................................................................. 2-1 2.2 Tier 1 - Low Seismic Hazard / High Seismic Margin Sites............................................. 2-4 2.2.1 Description of the Approach.................................................................................... 2-4

.................................................................................. 2-4 2.2.2.1 Integral Assessment........................................................................................ 2-4 2.2.2.2 Relays and Contactors..................................................................................... 2-2.2.3 Summary/Conclusion/Recommendation................................................................. 2-2.3 Tier 2 - Moderate Seismic Hazard / Moderate Seismic Margin Sites............................. 2-2.3.1 Description of the Approach.................................................................................... 2-

................................................................................ 2-11 2.3.3 Summary............................................................................................................... 2-12 2.4 Tier 3 - High Seismic Hazard / Low Seismic Margin Sites........................................... 2-12 3 SEISMIC PRA INSIGHTS AND TRIAL CATEGORIZATION STUDIES CONDUCTED ON HIGH SEISMIC HAZARD SITES........................................................................................ 3-1 3.1 Introduction to Trial Categorization Studies.................................................................... 3-1 46 1.1.2 Individual Plant Examination of External Events 1.1.3 Post Fukushima Seismic Reviews 1.1.3.1 NTTF Recommendation 2.3 Walkdowns 1.2 10 CFR 50.69 Categorization Process 1.3 Relationship to the Rule and Other Guidance Documents 2.2.2 Technical Basis for Approach 2.3.2 Technical Basis for Approach 5

6 5

6 6

6

xiv 3.2 Plant A Trial Categorization Evaluation........................................................................... 3-4 3.2.1 Introduction.............................................................................................................. 3-4 3.2.2 Seismic PRA High Safety Significant Evaluation..................................................... 3-4 3.2.2.1

...................................................................................................... 3-4 3.2.2.2 Description of Model Used for Analysis........................................................... 3-4 3.2.3 Full Power Internal Events PRA High Safety Significant Evaluation....................... 3-

...................................................................................................... 3-3.2.3.2 Description of Model Used for Analysis........................................................... 3-

.......... 3-3.2.4 Fire PRA High Safety Significant Evaluation........................................................... 3-3.2.4.1 Description of Model Used for Analysis........................................................... 3-

.......... 3-7 ison of Seismic PRA Results to Other PRA Results for High Safety Significant Structures, Systems, and Components.......................................................... 3-7

.............................................................................................. 3-7

.............................................................................................. 3-7 nalysis and Conclusions........................................................................................ 3-9

......................................................................... 3-3.3.1 Introduction............................................................................................................ 3-3.3.1.1 PRA Models................................................................................................... 3-3.3.2 Seismic PRA High Safety Significant Evaluation................................................... 3-17 3.3.2.1 Description of Seismic PRA Model................................................................ 3-17 3.3.2.2 Identification of HSS SSCs from the SPRA................................................... 3-18 3.3.3 Full Power Internal Events PRA High Safety Significant Evaluation..................... 3-18 3.3.4 Fire PRA High Safety Significant Evaluation......................................................... 3-19 Significant Evaluation Structures, Systems, and Components....................................... 3-19

................................................................................ 3-19

................................................................................ 3-19

....................................... 3-21 and Conclusions...................................................................................... 3-21 3.4 Plant C Trial Categorization Evaluation......................................................................... 3-30 3.4.1 Introduction............................................................................................................ 3-30 3.4.1.1 Plant Overview............................................................................................... 3-30 3.4.1.2 PRA Models................................................................................................... 3-30

Background

3.2.3.1 Background 5

5 5

3.2.3.3 Identification of Risk Criteria and Analysis of Component Importances 5

3.2.4.2 Identification of Risk Criteria and Analysis of Component Importances 3.2.5 Compar 3.2.5.1 Explicit Modeling 3.2.5.2 Implicit Modeling 3.2.6A 3.3 Plant B Trial Categorization Evaluation 3.3.5 Comparison of Seismic PRA results to other PRA results for High Safety 3.3.5.1 Explicitly Modeled SSCs 3.3.5.2 Implicitly Modeled SSCs 3.3.5.3 Correlation of SSCs and Common Cause Failures 3.3.6 Analysis 6

6 16 16 16

xv 3.4.2 Seismic PRA High Safety Significant Evaluation................................................... 3-31 3.4.2.1 Description of Seismic PRA Model................................................................ 3-31 3.4.2.2 Identification of HSS SSCs from the SPRA................................................... 3-32 3.4.3 Full Power Internal Events PRA High Safety Significant Evaluation..................... 3-32 3.4.4 Fire PRA High Safety Significant Evaluation......................................................... 3-32 esults for High Safety Significant Structures, Systems, and Components........................................................ 3-33

................................................................................ 3-33

................................................................................ 3-33

...................................................................................... 3-34

......................................................................... 3-40

............................................................................................................ 3-40

................................................... 3-40 RA High Safety Significant Evaluation..................... 3-41

......................................................... 3-41

.................. 3-41

................................................................................ 3-41

................................................................................ 3-41

.................................. 3-42

...................................................................................... 3-43

.......................................................................... 3-Components................................................................................................................... 3-

.................................................................................. 3-Relays.................................................................................................................... 3-

................................................................................................ 3-

-in-Depth Assessment.............................................................................. 3-

...................................................................................................... 3-4

SUMMARY

AND CONCLUSIONS......................................................................................... 4-1 5 REFERENCES....................................................................................................................... 5-1 A IDENTIFYING SEISMIC CORRELATED OR SEISMIC INTERACTION SCENARIOS FOR CONSIDERATION IN 50.69 CATEGORIZATION........................................................... A-1 A.1

..................................... A-1 A.2 Approach....................................................................................................................... A-2 3.4.5 Comparison of Seismic PRA Results to Other PRA R 3.4.5.1 Explicitly Modeled SSCs 3.4.5.2 Implicitly Modeled SSCs 3.4.6 Analysis and Conclusions 3.5 Plant D Trial Categorization Evaluation 3.5.1 Introduction 3.5.2 Seismic PRA High Safety Significant Evaluation 3.5.3 Full Power Internal Events P 3.5.4 Fire PRA High Safety Significant Evaluation 3.5.5 Comparison of SPRA results to the FPIE PRA results for HSS SSCs 3.5.5.1 Explicitly Modeled SSCs 3.5.5.2 Implicitly Modeled SSCs 3.5.5.3 Seismic Fragility Groups and Common Cause Failure 3.5.6 Analysis and Conclusions 3.6 Summary of Sensitivity Study Insights 3.6.1 Limited Unique Seismic High Safety Significant Structures, Systems, and 3.6.2 Seismic Correlated Failures 3.6.3 3.6.4 FLEX Components 3.6.5 Defense 3.6.6 Civil Structures Background on Seismic Correlation Considerations in SPRAs 59 59 59 59 60 61 61

xvi B CRITERIA FOR CAPACITY-BASED SCREENING FOR HIGH CAPACITY SSCS............. B-1

....................................................................................................................... -1

.................................................................................................................... -2

..................................................................................................................... -3 8.1 Approach 8.2 Justification 8.3 Conclusion 8

8 8

xvii LIST OF FIGURES Figure 1-

-09)................................................. 1-9 Figure 1-

......... 1-13 Figure 2-

....................................... 2-3 Figure 2-

................................ 2-3 Figure 2-3 Seismic Correlated Failure Assessment................................................................... 2-9 Figure 3-Comparison........................................................................................................................ 3-2 Figure 3-2 Comparison........................................................................................................................ 3-2 Figure 3-Comparison........................................................................................................................ 3-3 Figure 3-Comparison........................................................................................................................ 3-3 Figure 3-

........... 3-10 1 Categorization Process Overview (from NEI 16 2 Relationship With the 10 CFR 50.69 Rule and Other Guidance Documents 1 Low Seismic Hazard Site: Low GMRS Peak Acceleration 2 Low Seismic Hazard Site: Typical SSE to GMRS Comparison 1 Plant A Ground Motion Response Spectrum to Safe Shutdown Earthquake Plant B Ground Motion Response Spectrum to Safe Shutdown Earthquake 3 Plant C Ground Motion Response Spectrum to Safe Shutdown Earthquake 4 Plant D Ground Motion Response Spectrum to Safe Shutdown Earthquake 5 High Safety Significant Structures, Systems, and Components for Plant A

xix LIST OF TABLES Table 1-1 Integrated Decision-om Preliminary High Safety Significant to Low Safety Significant................................................................................ 1-12 Table 2-

..................................................................................................................... 2-4 Table 3-1 Trial Plant Summary.................................................................................................. 3-1 Table 3-

-04............................................................................... 3-Table 3-

................................................... 3-7 Table 3-4 Seismic Fragilities Addressed by Implicit Modeling................................................... 3-8 Table 3-

........................................................................ 3-11 Table 3-

............................................................ 3-20 Table 3-

........................................................................ 3-22 Table 3-8 Plant C Passive or Implicitly Modeled SSCs........................................................... 3-34 Table 3-9 Sensitivity Study Results for Plant C....................................................................... 3-Table 3-10 Plant D Passive or Implicitly Modeled SSCs......................................................... 3-42 Table 3-11 Sensitivity Study Results for Plant D..................................................................... 3-44 Table 4-

................. 4-2 Table A-

................................ A-2

-1 Seismic Fragility References.................................................................................... -2 Making Panel Changes fr 1 Plants Performing Seismic Probabilistic Risk Assessments for the Fukushima 50.54(f) Letter 2 PRA Risk Criteria per NEI 00 3 Seismic Fragilities Addressed by Explicit Modeling 5 Sensitivity Study Results for Plant A 6 Plant B Passive or Implicitly Modeled SSCs 7 Sensitivity Study Results for Plant B 1 Alternate Approach Seismic Tiers and Seismic Rick Evaluation Process 1 Correlation Guidance from Sandia National Laboratory Study 6

35 Table B B

1-1 1

BACKGROUND The U. S. Nuclear Regulatory Commission (NRC) amended its regulations to provide an alternative approach for establishing the requirements for treatment of structures, systems and components (SSCs) for nuclear power reactors using a risk-informed method of categorizing SSCs according to their safety significance. The NRCs 10 CFR 50.69 process [1] allows a plant to categorize SSCs using a robust categorization process defined in NEI 00-04, 10 CFR 50.69 SSC Categorization Guideline [2], as endorsed by NRC in Regulatory Guide 1.201 [3]. The risk-informed categorization process helps focus attention on SSCs that are the most important to plant safety while allowing increased operational flexibility for SSCs that are less important to plant safety.

One of the criteria evaluated in the categorization process specified in NEI 00-04 is seismic risks, which can be evaluated using a seismic probabilistic risk assessment (Seismic PRA or SPRA), or a seismic margin assessment (SMA) if an SPRA is not available, or screened out if the seismic core damage frequency (SCDF) and seismic large early release frequency (SLERF) are very small compared to the full power internal events (FPIE) PRA CDF and LERF.

There are a number of plants that do not have an SPRA or SMA available to assess seismic risk in the categorization process and cannot screen out of seismic considerations by demonstrating very low seismic risks compared to FPIE risks, therefore a need exists to consider alternatives for considering the insights of seismic risks in the 50.69 categorization process. This report develops alternate approaches for plants to provide the necessary seismic risk insights within the 50.69 categorization process.

1.1 Seismic Evaluations at Nuclear Power Plants Nuclear power plants are built to withstand environmental hazards, including earthquakes. The nuclear power plant regulatory process requires that seismic activity be taken into account as part of the design, operation and maintenance of the nuclear fleet. Safety-significant structures, systems, and components (SSC) are designed to withstand the effects of earthquakes and to maintain the capability to perform their intended safety functions. Several codes and standards govern aspects that directly affect the seismic margins inherent in the nuclear plants along with the estimation of the seismic risks, including standards from the American National Standards Institute (ANSI), American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (BPVC), American Concrete Institute, and the Institute of Electrical and Electronics Engineers (IEEE).

Historically, when significant new seismic hazard information or new seismic capacity information became available, an assessment of this new data and models was undertaken to assess the impacts of this new data/methods. Several such major seismic reassessments have taken place in the United States that have impacted the majority of the nuclear plants in the fleet.

=

Background===

1-2

1. Unresolved Safety Issue A-46 (Generic Letter 87-02) [4]) - Operability of safety related equipment subjected to earthquakes

2. Individual Plant Examination of External Events (IPEEE) For Severe Accident Vulnerabilities - 10 CFR 50.54(f), (Generic Letter No. 88-20, Supplement 4), [5] -

Seismicity of sites and beyond design basis evaluation

3. NRC Fukushima 50.54(f) letter [6] - Post Fukushima seismic reviews The insights and conclusions from these seismic programs provide a good calibration for the proposed categorization of seismic risk/margin insights within the 50.69 categorization process.

1.1.1 Unresolved Safety Issue A-46 In December 1980, the U.S. Nuclear Regulatory Commission (NRC) initiated Unresolved Safety Issue (USI) A-46, Seismic Qualification of Equipment in Operating Nuclear Plants, [4] to address concerns that seismic qualification of equipment in older nuclear power plants might not be meeting expectations of newer seismic qualification criteria. The purpose of the USI A-46 program was to verify the seismic adequacy of essential equipment in operating plants not qualified in accordance with more recent criteria (that is IEEE 344-1975 [7]). In 1982, the Seismic Qualification Utility Group (SQUG) was formed to develop a practical approach for seismic qualification of equipment in operating plants. The approach developed by SQUG used experience data from equipment in power plants and industrial facilities that experienced actual earthquakes as the primary basis for evaluating the seismic ruggedness and functionality of essential equipment in nuclear power plants. A generic implementation procedure (GIP) [8] was developed that included the evaluation of active electrical and mechanical equipment, relay performance, tanks, heat exchangers cable raceways, and identification and resolution of possible seismic spatial systems interactions. Emphasis was placed on anchorage of equipment (a key insight that contributed to a significant number of earthquake equipment failures) and seismic walkdowns (a key tool to validating the installed condition of plant equipment and confirming characteristics of seismically rugged equipment).

A significant finding of the earthquake experience research is that conventional electrical and mechanical equipment included in the scope of the GIP will withstand earthquakes significantly higher than the design basis earthquakes for eastern U.S. nuclear plants, provided a set of key conditions are met. The guidelines in the GIP provide a systematic, controlled, and well-documented method of applying the lessons learned from review of earthquake experience data.

The GIP screens out those types of conventional equipment that have been shown to be insensitive to earthquake motions expected in eastern U.S. plants and focuses on actual equipment and installation vulnerabilities identified in strong motion earthquakes as well as prior qualification test experience. Modifications were typically made for the safe shutdown equipment that did not meet the GIP criteria.

=

Background===

1-3 1.1.2 Individual Plant Examination of External Events On June 28, 1991, the NRC issued Supplement 4 to Generic Letter (GL) 88-20, "Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities" [4]. This supplement to GL 88-20, referred to as the IPEEE program, requested that each licensee identify and report to the NRC all plant-specific vulnerabilities to severe accidents caused by external events. The IPEEE program included the following four supporting objectives:

Develop an appreciation of severe accident behavior Understand the most likely severe accident sequences that could occur at the licensee's plant under full-power operating conditions Gain a qualitative understanding of the overall likelihood of core damage and fission product releases Reduce, if necessary, the overall likelihood of core damage and radioactive material releases by modifying, where appropriate, hardware and procedures that would help prevent or mitigate severe accidents Seismic loading was one of the key elements of the IPEEE program. The IPEEE program resulted in a comprehensive seismic risk/margin assessment for the U.S. NPP fleet and, as such, represents a valuable resource for risk-informed applications such as 10 CFR 50.69.

The seismic IPEEE review results for 110 units are summarized in the EPRI 1000895 [9]1. Of the 75 submittals reviewed, 28 submittals (41 units) used seismic probabilistic risk assessment (PRA) methodology; 45 submittals (65 units) performed seismic margin assessments (SMAs);

and two submittals (four units) used site-specific seismic programs for IPEEE submittals.

Almost all licensees reported in their IPEEE submittals that no plant vulnerabilities were identified with respect to seismic risk (the use of the term "vulnerability" varied widely among the IPEEE submittals). However, most licensees did report at least some seismic "anomalies,"

"outliers," or other concerns. In the few submittals that did identify a seismic vulnerability, the findings were comparable to those identified as outliers or anomalies in other IPEEE submittals.

Seventy percent of the plants proposed improvements as a result of their seismic IPEEE analyses.

1 NRC performed a comparable review of IPEEE results in NUREG-1742, Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) Program. [39]

=

Background===

1-4 1.1.3 Post Fukushima Seismic Reviews Following the accident at the Fukushima Daiichi nuclear power plant resulting from the March 11, 2011, Great Tohoku Earthquake and subsequent tsunami, the NRC established a Near Term Task Force (NTTF) to conduct a systematic review of NRC processes and regulations. The NTTF was also tasked with determining if the agency should make additional improvements to its regulatory system. The NRC issued an information request [6] associated with a seismic assessment on March 12, 2012, including recommendations 2.1 and 2.3 which required seismic evaluations and seismic walkdowns respectively. In addition, one other seismic program that came out of the post Fukushima requirements consisted of an assessment of the new mitigation strategies put into place under NTTF Recommendation 4 [6] by each nuclear plant. Each of these three post Fukushima seismic-related programs are briefly summarized below.

1.1.3.1 NTTF Recommendation 2.3 The NTTF 2.3 program consisted of a relatively near term walkdown review of a sample of the safety related equipment in each U.S. nuclear plant to assess the seismic adequacy. The NRC requested that a walkdown review be conducted to address the plant specific vulnerabilities and to verify the seismic adequacy of the plant to the design basis level. EPRI 1025286 [10] provided technical guidance in 2012 for performing walkdowns to address the NTTF 2.3 request.

Lessons learned from these NTTF 2.3 walkdown reviews consisted of the following:

The vast majority of the equipment and systems reviewed were demonstrated to be seismically adequate and in compliance with the design basis.

A relatively minor number of issues were noted from these walkdown reviews:

- Some anchorage conditions were identified that required actions to restore to the original condition

- Some seismic interaction issues were noted

- Some degraded equipment/hardware were noted (missing parts, corrosion, leaks, etc.)

Any issues identified as part of the NTTF 2.3 walkdowns were addressed by the licensees under their corrective action programs.

1.1.3.2 NTTF Recommendation 2.1 Seismic Evaluations NTTF 2.1 was the longer term more detailed assessment of the implications of new seismic hazards on plant risk. The requested seismic information associated with recommendation 2.1 consisted of:

Updated site-specific seismic hazards at operating nuclear power plants (NPPs)

A seismic risk evaluation (SMA or seismic probabilistic risk assessment (SPRA)), as applicable, using the updated seismic hazard An assessment of the spent fuel pool (SFP) using the updated seismic hazard Walkdowns

=

Background===

1-5 The NRC requested each U.S. nuclear plant to provide information about the current hazard and potential risk posed by seismic events using a graded screening/evaluation approach. Depending on the comparison between the re-evaluated seismic hazard and the current seismic design basis, plants were requested to perform increasing levels of reevaluations. EPRI 1025287 [11] (known as the SPID) documents the methods undertaken by the U.S. nuclear industry to respond to the NTTF 2.1 request.

All U.S. nuclear plants performed a detailed reevaluation of the seismic hazard using modern Probabilistic Seismic Hazard Analysis (PSHA) criteria. These new seismic hazards were reviewed and approved by the NRC and formed the basis for the remainder of the NTTF 2.1 seismic evaluations. A significant number of U.S. plants completed (or are in the process of completing) SPRAs to address the NTTF 2.1 requirements. Four of the plants with new SPRAs have performed sensitivity studies documented in Section 3 to determine if there are any unique seismic insights that contribute to the 10 CFR 50.69 categorization process.

1.1.3.3 Mitigation Strategy Assessment The third program that provided seismic insights for the U.S. NPP fleet consisted of a mitigation strategy assessment (MSA) conducted by all U.S. nuclear plants associated with the beyond seismic design basis evaluations of new mitigation equipment procured following the Fukushima event. The U.S. nuclear power industry initiated a program to add new capabilities and equipment to each plant. This initiative is referred to as FLEX [12] and includes the incorporation of strategies to safely respond to an assumed extended loss of alternating current (AC) power (ELAP) with a loss of normal access to the ultimate heat sink (LUHS) from an unspecified event. The NRC developed a recent regulation (NRC Draft Rule - Mitigation of Beyond Design Basis Events [13]) which required a beyond design basis review for these new FLEX mitigation systems. Relative to earthquakes, this rule required the assessment of the impact on the mitigation systems to the newly re-evaluated seismic hazards.

NEI has documented a detailed approach to demonstrate the seismic adequacy of mitigation strategy systems in NEI 12-06 Appendix H [12]. The seismic methods and criteria for evaluating MSA seismic adequacy incudes a graded approach. Five separate paths have increased requirements as a function of the degree that the latest seismic hazard exceeds the seismic design basis at the nuclear plant. In addition, these paths also take into account the degree/quality of existing seismic risk/margin evaluations that exist for the plant. The requirements and detail of these paths appropriately increase as the potential risk associated with the beyond design basis seismic event is deemed to potentially increase based on screening criteria agreed to by both the NEI/EPRI team as well as the NRC.

=

Background===

1-6 The MSA evaluations require demonstration that the FLEX strategies developed, implemented and maintained in accordance with NRC Order EA-12-049 [14] can be implemented considering the impacts of the reevaluated seismic hazard. The seismic insights from the seismic MSA assessments completed to date included many of the same insights observed from previous seismic programs:

Anchorage of the equipment is important in the seismic event Seismic walkdowns by trained engineers are critical to identifying key issues that can best be identified in the field (for example, seismic interactions and vulnerabilities in operator pathways)

Operator actions following the seismic event can address some seismic anomalies that occur during the earthquake (for example, resetting of relays, clearing operator pathways of smaller fallen objects) 1.1.4 Insights from Past Seismic Programs and Studies A collective set of insights can be gained from the major seismic programs described above.

While these programs varied in terms of their vintage and their required scope, the seismic insights have been quite consistent.

Most SSCs have an inherent degree of seismic ruggedness

- Earthquake experience data from large historical earthquakes have shown that the majority of equipment and structure types existing at nuclear power plants perform very well.

- Mechanical equipment (pumps, valves, compressors, diesel generators) have a significant amount of seismic margin due to their being designed for operating loads in addition to the seismic loads.

- Shake table test data demonstrate even higher levels of seismic capacity for safety related SSCs.

- Distributed systems (HVAC ducting, cable trays, welded steel piping) perform very well in earthquakes and tests and have high inherent ruggedness A limited set of failure modes and seismic risk contributors exist

- Anchorage - Anchorage is one of the key failure modes that results from earthquakes.

For the safety-related nuclear plant equipment and systems, applicable design codes and standards require that seismic margin be designed into the anchorage. As such, for the moderate hazard sites, anchorage is not expected to contribute to the seismic risk until the earthquake reaches several times the design level.

- Brittle Failure modes - Examples of a brittle failure mode could include configurations such as ceramic materials in electrical equipment or of cast iron anchorage. Past seismic programs such as the USI A-46 and the IPEEE seismic programs have identified these brittle failure modes and where these were identified as issues, modifications were typically conducted.

=

Background===

1-7 Relay chatter - relay chatter for certain types of relays can occur at moderate earthquake levels. The most problematic relays (referred to as bad actors) were reviewed and addressed already as part of the USI A-46 program. Since relay chatter does not represent a failure of the relay (the relay functions normally following the earthquake), operator actions can be undertaken to address relay chatter effects during the earthquake.

- Seismic interactions - insights from past earthquakes have shown that seismic interactions (block walls falling, lights falling, impact from cabinet deflections, seismic-induced flooding, etc.) can happen at moderate earthquake levels. The most appropriate method to identify these interactions is based on a trained team of engineers performing a walkdown. These walkdowns were integral parts of all three of the seismic programs summarized in Sections 1.1.1 through 1.1.3 above.

- Seismic correlation - Insights from past earthquakes have shown that the seismic damage to similar equipment/systems which are subjected to the same earthquake motions can be correlated. As such, if one cabinet fails during an earthquake, there is a reasonable chance that a similar cabinet in the same area could also fail during the earthquake2. The seismic correlation insights from past studies2 are unique to seismic risk studies and are accounted for in an SPRA.

These collective insights have been integrated into the proposed alternate approaches for addressing the seismic risk in the 10 CFR 50.69 risk-informed categorization approach recommended in this report.

1.2 10 CFR 50.69 Categorization Process NEI 00-04 [2] as endorsed in Regulatory Guide 1.201 [3] is one acceptable method for conducting a risk-informed categorization of structures, systems and components (SSCs) that provides evidence and confidence that SSCs will be categorized in a robust and integrated process consistent with 10 CFR 50.69(c)(1)(iv) [1]. The categorization process is performed for entire systems, one or more systems at a time, to ensure that all functions (which are primarily a system-level attribute) for a given component within a given system are appropriately considered.

The process described in NEI 00-04 and presented in Figure 1-1 [16] contains a number of key elements which are summarized below. These elements are used to arrive at a preliminary component categorization (that is, High Safety Significant (HSS) or Low Safety Significant (LSS)).

1. Full power internal events PRA

2. Internal and external hazards

3. Seven qualitative criteria in Section 9.2 of NEI 00 04

4. Defense-in-depth assessment

5. Passive categorization methodology 2 See discussion in Appendix A

=

Background===

1-8 The analyses that can be used to address the hazards in items 1 and 2 above include:

Internal Event Risk Analysis: Full power internal events PRA, including internal flooding.

Internal Fire Events: EPRI Fire Induced Vulnerability Evaluation (FIVE) [15] screening process or Fire PRA.

Seismic Events: Success Path Component List3 (SPCL) from an IPEEE seismic margin analysis, SPRA or screening if the SPRA CDF is a small fraction of the internal events CDF (that is, <1%).

Other External Events: (for example, tornados, external floods): External [hazard] PRA model and / or IPEEE screening process.

Low Power and Shutdown Risks: Qualitative defense-in-depth (DID) shutdown model for shutdown configuration risk management (CRM) based on the framework for DID provided in NUMARC 91-06, Guidance for Industry Actions to Assess Shutdown Management.

3 The term SPCL is used interchangeably in many seismic IPEEE documents with Safe Shutdown Equipment List (SSEL).

Identify System Boundary and Components Identify System Functions

+

Qualitative Categorization Evaluate Risk of Each Function1 Collect System Evaluate Qualitative Map Each Component Operational Risk of Components to Function Information on sscs Evaluate Risk in Non-PRA Modeled Hazards Evaluate Risk in Shutdown Modes Probabilistic Risk Assessment Categorization Component Risk from PRA Internal Events Component Risk from Other PRA Models No Perform Sensitivity Study Yes Yes No PRA Integrated Component Risk Perform Sensitivity Study Passive Cate9orization

@ 2018 NEI. All rights reserved.

Figure 1-1 Categorization Process Overview (from NEI 16-09) 1 Preliminary HSS if supporting Components are HSS from PRA Internal Events, PRA Integrated Risk 2 cannot be overridden by IDP 3 Safety related HSS SSCs revised by the IDP to be LSS should be confirmed by the Defense in Depth Evaluation 4 Critical attributes shou ld be determined for all final HSS components HSS

Background

LSS3 1-9

=

Background===

1-10 With respect to the seven qualitative criteria contain in Section 9.2 of NEI 00-04, the purpose of these considerations is to determine whether these functions/SSCs are not implicitly depended upon to maintain safe shutdown capability, prevention of core damage and maintenance of containment integrity. Specifically, consideration is given to whether:

1. Failure of the active function/SSC will not directly cause an initiating event that was originally screened out of the PRA based on anticipated low frequency of occurrence.

2. Failure of the active function/SSC will not cause a loss of reactor coolant pressure boundary integrity resulting in leakage beyond normal makeup capability.

3. Failure of the active function/SSC will not adversely affect the defense-in-depth remaining to perform the function.

4. The active function/SSC is not called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means for the successful performance of operator actions required to mitigate an accident or transient.

5. The active function/SSC is not called out or relied upon in the plant Emergency/Abnormal Operating Procedures or similar guidance as the sole means of achieving actions for assuring long term containment integrity, monitoring of post-accident conditions, or offsite emergency planning activities.

6. Failure of the active function/SSC will not prevent the plant from reaching or maintaining safe shutdown conditions; and the active function/SSC is not significant to safety during mode changes or shutdown.

7. Failure of the active function/SSC that acts as a barrier to fission product release during plant operation or during severe accidents would not result in the implementation of off-site radiological protective actions.

As discussed in Sections 6 and 9 of NEI 00-04 [2], in cases where the component is safety-related and found to be of low risk significance, it is appropriate to confirm that defense-in-depth is preserved. This includes consideration of the events mitigated, the functions performed, the other systems that support those functions and the complement of other plant capabilities that can be relied upon to prevent core damage and large, early release. Specific criteria are provided for assessing core damage defense-in-depth, including preventing core damage and limiting the frequency of the events being mitigated (Section 6.1), and containment defense-in-depth, including containment bypass, containment isolation, early hydrogen burns and long-term containment integrity (Section 6.2).

=

Background===

1-11 Per NEI 00-04, Defense-in-Depth is maintained if:

1. Reasonable balance is preserved among prevention of core damage, prevention of containment failure or bypass, and mitigation of consequences of an offsite release.

2. There is no over-reliance on programmatic activities and operator actions to compensate for weaknesses in the plant design.

3. System redundancy, independence, and diversity are preserved commensurate with the expected frequency of challenges, consequences of failure of the system, and associated uncertainties in determining these parameters.

4. Potential for common cause failures is taken into account in the risk analysis categorization.

5. The overall redundancy and diversity among the plants systems and barriers is sufficient to ensure that no significant increase in risk would occur.

Finally, pressure boundary components (that is passive components and the passive function of active components) are evaluated using a consequence assessment approach where the component failure is assumed with a probability of 1.0 and only the consequence evaluation is performed. It relies on the conditional core damage and large early release probabilities associated with postulated ruptures. This approach is conservative compared to including the rupture frequency in the categorization as this approach will not allow the categorization of SSCs to be affected by any changes in frequency due to changes in treatment. Deterministic considerations (for example, DID, safety margins) are then also applied to determine the final safety significance from a passive perspective. Component supports are assigned the same safety significance as the highest passively ranked component within the bounds of the associated analytical pipe stress model.

As can be clearly seen, the determination of safety significance through the various elements identified above provides a robust and integrated categorization of SSCs. The results of these elements are used as inputs to arrive at a preliminary component categorization (that is, High Safety Significant (HSS) or Low Safety Significant (LSS)) that is then presented to the Integrated Decision-Making Panel (IDP), a multi-discipline panel of experts that reviews the results of the initial categorization and finalizes the categorization of the SSCs/functions. Note:

the term preliminary HSS or LSS is synonymous with the NEI 00-04 term candidate HSS or LSS. A component or function is preliminarily categorized as HSS if any element of the process results in a preliminary HSS determination in accordance with Table 1-1 below. Consistent with NEI 00-04, the categorization of a component or function will only be preliminary until it has been confirmed by the IDP. Once the IDP confirms that the categorization process was followed appropriately, the final Risk Informed Safety Class (RISC) category can be assigned.

The IDP may direct and approve detailed categorization of components in accordance with NEI 00-04 Section 10.2. The IDP may always elect to change a preliminary LSS component or function to HSS, however the ability to change component categorization from preliminary HSS to LSS is limited. This ability is only available to the IDP for select process steps as described in NEI 00-04 [2] and endorsed by RG 1.201 [3]. Table 1-1 summarizes these IDP limitations in NEI 00-04. The steps of the process are performed at either the function level, component level, or both. This is also summarized in the Table 1-1. A component is assigned its final RISC category upon approval by the IDP.

=

Background===

1-12 As a final note relative to the purpose of this report, the NEI 00-04 section on Integrated Risk Assessment includes the following.

Each risk contributor is initially evaluated separately in order to avoid reliance on a combined result that may mask the results of individual risk contributors. The potential masking is due to the significant differences in the methods, assumptions, conservatisms and uncertainties associated with the risk evaluation of each. In general, the quantification of risks due to external events and non-power operations tend to contain more conservatisms than internal events, at-power risks. As a result, performing the categorization simply on the basis of a mathematically combined total CDF/LERF would lead to inappropriate conclusions. However, it is desirable in a risk-informed process to understand safety significance from an overall perspective, especially for SSCs that were found to be safety-significant due to one or more of these risk contributors.

Table 1-1 Integrated Decision-Making Panel Changes from Preliminary High Safety Significant to Low Safety Significant Element Categorization Step -

NEI 00-04 Section Evaluation Level IDP Change HSS to LSS Drives Associated Functions Modeled)

Case -

Component Not Allowed Fire, Seismic and Allowable No PRA Sensitivity Studies Allowable No Integral PRA Assessment - Section Not Allowed modeled)

Fire, Seismic and Hazards -

Component Not Allowed No Shutdown - Section Function/Component Not Allowed No Defense-in-Depth Core Damage -

Function/Component Not Allowed Containment -

Component Not Allowed Qualitative Criteria Considerations -

Section 9.2 Function Allowable N/A Passive Passive - Section 4 Segment/Component Not Allowed No Internal Events Base Section 5.1 Yes Other External Events Risk (PRA Base Case Yes 5.6 Other External Risk (Non 5.5 Section 6.1 Yes Section 6.2 Yes

=

Background===

1-13 1.3 Relationship to the Rule and Other Guidance Documents Figure 1-2 illustrates how this report relates to the 50.69 Rule [1] and other guidance documents.

Requirements for implementing risk-informed categorization and treatment of SSCs are described in 10 CFR 50.69 [1], the adoption of which is optional by each licensee. The rule provides requirements for both phases of implementation; categorization and the resulting treatment allowances.

Figure 1-2 Relationship With the 10 CFR 50.69 Rule and Other Guidance Documents EPRI Regulatory Guidance RG 1.174(2)

RG 1.200(3)

RG 1.201(4)

NEI 00-04 (Categorization)

NEI 16-09 (Implementation)

NEI 17-05 (Treatment)

EPRI 1011234 (Implementation & Treatment}

Supplemental Guidance EPRI 1009748 (Alternative Treatment to EQ Applications}

EPRI 1011783 (RISC-3 Seismic Assessment}

EPRI 1015099 (Special Treatment}

EPRI 1022945 (Risk-Informed Repair/Replacement}

EPRI 3002012984 (Risk-informed Categorization}

Notes:

EPRI 3002012990 (Alternative Treatment Case Studies}

EPRI 3002015999 (Enhanced Risk-Informed Categorization Methodology for Pressure Boundary Components}

EPRI 3002017583 (Alternative Approaches for Addressing Seismic Risk}

{1) "50.69 Risk-informed categorization and t reatment of structures, systems and components for nuclear power reactors" (2) "An approach fo r using probabilistic risk assessment in risk-informed decisions on plant-specific changes to the licensing basis" (3) "An approach fo r determining the technical adequacy of probabi listic risk assessment resu lts for risk-informed activities" (4) "Guidance for categorizing structures, systems and components in nuclear power plants according to their safety significance"

2-1 2

PROPOSED APPROACH The current approaches in NEI 00-04 [2] for considering seismic risks in the categorization process include the following options.

An SPRA can be used with specified risk ranking and sensitivity studies to determine seismic related HSS SSCs; it is expected that an SPRA used for this purpose would meet RG 1.200

[17]

An IPEEE Seismic Margins Assessment (SMA) equipment list can be used where all of the SSCs on the equipment list are designated HSS If the SPRA CDF is a small fraction of the internal events CDF (that is, <1%), then safety significance of SSCs considered in the SPRA can be considered LSS from a seismic perspective.

There are a number of plants that do not fit into any of these options. These are typically plants with moderate seismic hazards that did not use an SMA for their IPEEE response and were not required to perform an SPRA to respond to the NRCs Fukushima 50.54(f) letter [6]. This situation prompted a review for alternatives that could provide the appropriate seismic related insights to the categorization process.

A series of test cases were evaluated at sites with high seismic hazards and RG 1.200 compliant SPRAs to determine the types of seismic insights that would contribute to 50.69 categorization decisions. These test cases, described in Section 3, led to the development of the graded approach for categorization of seismic inputs described in this section.

2.1 Overview of Approaches A graded approach is recommended that supports the 50.69 categorization process. The key premise of the approach is that most seismic related SSCs that would be categorized as HSS in accordance with NEI 00-04 would also be categorized as HSS for other reasons (that is internal events PRA insights, other external hazard risk insights, Defense-in-Depth considerations).

Therefore, the goal of the graded approach is to identify SSCs that may be categorized as HSS based solely on seismic risk insights.

A second key premise is that the degree to which the plant seismic hazard, represented by the ground motion response spectrum (GMRS), exceeds the plant seismic design basis, represented by the Safe Shutdown Earthquake (SSE), influences the likelihood that unique seismic-related HSS SSCs will be identified. The 50.69 categorization process uses the F-V and RAW importance measures to determine relative ranking of the PRA SSCs. Since these are relative risk measures, even at a plant with low seismic hazards, there will always be a distribution of relative importance measures from high to low. However, at higher seismic hazard plants, the chances of identifying an unusual seismic induced condition that would cause SSCs to be HSS is greater.

For example, the likelihood that nearby block walls will collapse and prevent important SSCs

Proposed Approach 2-2 from performing their required functions becomes greater as the seismic hazard increases. In addition, the available seismic margin even in seismically designed SSCs, decreases as the seismic hazard increases, leading to greater likelihood of seismically induced failures and greater challenges to plant systems. Therefore, 50.69 seismic categorization test cases performed using plants with high seismic hazards relative to their seismic design basis would be more likely to identify unique conditions that would lead to the identification of HSS SSCs for unique seismic related reasons. Thus, plants with relatively high seismic hazard were chosen as test cases for the graded approach.

Three tiers are recommended within this graded approach. The primary measure for determining the appropriate tier for a plant is similar to the grading process used in EPRI 1025287 [11] for the Fukushima 50.54(f) letter responses and in NEI 12-06 [12] for the Mitigation Strategy Assessment. This measure is a comparison of the site-specific ground motion response spectrum (GMRS) to the site plant design basis (typically the Safe Shutdown Earthquake (SSE)) over the frequency range of 1.0 to 10 Hz. At sites where the GMRS/SSE ratio is low, there is a lower chance that seismic unique insights would contribute to HSS categorization. At sites where the GMRS/SSE ratio is higher, there are higher chances that seismic unique insights would contribute to HSS categorization.

The three recommended tiers are the following.

Tier 1: Plants where the GMRS peak acceleration is at or below approximately 0.2g or where the GMRS is below or approximately equal to the SSE between 1.0 Hz and 10 Hz. Examples are shown in Figures 2-1 and 2-2. At these sites, the GMRS is either very low or within the range of the SSE such that unique seismic categorization insights are not expected.

Tier 2: Plants where the GMRS to SSE comparison between 1.0 Hz and 10 Hz is greater than in Tier 1 but not high enough to be treated as Tier 3. At these sites, the unique seismic categorization insights are expected to be limited.

Tier 3: Plants where the GMRS to SSE comparison between 1.0 Hz and 10 Hz is high enough that the NRC required the plant to perform an SPRA to respond to the Fukushima 50.54(f) letter [6]. The NRC used a variety of site-specific quantitative and qualitative considerations in making these decisions [for example, 40, 41] and it represents the best available assessment of when an SPRA should be employed in risk-informed evaluations.

The plants in this category are listed in Table 2-14. Note that several plants planning to shutdown applied for, and received extensions of their SPRA due dates. Those plants are not included in Table 2-1.

4 Note that several plants planning to shutdown applied for, and received extensions of their SPRA due dates from the NRC. Those plants are not included in Table 2-1. If those shutdown decisions change, they could be treated consistent with Tier 3 plants.

Proposed Approach 2-3 Figure 2-1 Low Seismic Hazard Site: Low GMRS Peak Acceleration Figure 2-2 Low Seismic Hazard Site: Typical SSE to GMRS Comparison C

0 0.80 0.60

~ 0.40 Cl/

Qi u u ct C

0 0.20 0.00 0.80 0.60

~ 0.40 Cl/

Qi u

u ct 0.20 0.00

~

0.10 0.10 I

I

+

Safe Shutdown I

Earthquake I

Ground Motion

+

Response Spectrum I

I I I I I I

11 I

I I I

~,,,.............._

I I ~J-V" I_,-,,-

~ 1""-1.J.:,

.A ~

I

""'""'111~

I

__, - I I

1.00 10.00 Frequency (Hz}

I I

Safe Shutdown I

Earthquake I

I Ground Motion Response Spectrum I

I I

I I I

I I

I I.

/ ""I,~

I I I v~

I I ~ ""-

I I

I

~

I I

I I I

..-r, b,,,~~ J_,..

1...,...1""'"1 I

I

~

I I

r- ~1--ht"""'

I 1.00 10.00 Frequency (Hz}

I I

I

--~

I I

I I

I I

I I

I I

I 11 I

I I

100.00 I

I I

I I

I I

I I

I I

I

~,

I

~ I 11

-.......,1 I I

I I

100.00

Proposed Approach 2-4 Table 2-1 Plants Performing Seismic Probabilistic Risk Assessments for the Fukushima 50.54(f)

Letter Beaver Valley DC Cook Oconee Sequoyah Diablo Canyon Palisades VC Summer Callaway Dresden m

Vogtle Columbia North Anna Robinson The criteria for considering seismic risk insights in the 50.69 categorization process for each Tier is described below.

2.2 Tier 1 - Low Seismic Hazard / High Seismic Margin Sites 2.2.1 Description of the Approach For Tier 1 plants, the GMRS is either very low or similar to the SSE such that unique seismic categorization insights are expected to be minimal. Since little to no unique seismic insights, would be anticipated for such sites, the approach is to rely on the 50.69 categorization process using the full power internal events (FPIE) and other risk evaluations along with the Defense-in-Depth, passive evaluations, and Integrated Decision-making Panel (IDP) assessment of the qualitative criteria. This process is expected to adequately identify the safety-significant functions and SSCs required for those functions.

2.2.2 Technical Basis for Approach The test cases described in Section 3 showed that even for plants with high seismic ground motions compared to their design basis, there would be very few if any SSCs designated HSS for seismic unique reasons. At the low seismic hazard sites in Tier 1, the likelihood of identifying a unique seismic condition that would cause an SSC to be designated HSS is very low.

2.2.2.1 Integral Assessment In addition, since the seismic hazards for these sites are low, the seismic CDF would also be expected to be low. This is important because the NEI 00-04 [2] categorization process includes an Integral Assessment that weights the importance from each risk contributor (for example, internal events, fire, SPRAs) by the fraction of the total core damage frequency contributed by that contributor. The risk from an external hazard only drives a component to a required HSS determination if the results of the integral assessment meet the importance measure criteria for HSS. The integral assessment uses the following equations.

Browns Ferry Peach Botto watts Bar

Proposed Approach 2-5

=

, x Equation 2-1 Integrated Fussell-Vesely Importance

where, IFVi = Integrated F-V Importance of Component i over all CDF Contributors FVi, j = F-V Importance of Component i for CDF Contributor j CDFj = CDF of Contributor j

= 1 +

1 x Equation 2-2 Integrated Risk Achievement Worth Importance

where, IRAWi = Integrated Risk Achievement Worth of Component i over all CDF Contributors RAWi, j = Risk Achievement Worth of Component i for CDF Contributor j CDFj = CDF of Contributor j Using these equations, if the seismic CDF is low, then the SSC importance measures from the SPRA are weighted lower than other risk contributors and the resulting seismic inputs to the categorization process are weighted lower. This would further reduce the likelihood of identifying a unique seismic condition that would cause an SSC to be designated HSS 2.2.2.2 Relays and Contactors The categorization of relays and contactors warrants some additional discussion of how they are addressed in the 50.69 categorization process. Relays and contactors are often considered to be seismically sensitive items and their performance during earthquakes can be important contributors to seismic risks.

FPIE PRAs do not typically model relays explicitly. They are included implicitly as part of modeled assemblies such as Control Panels and Motor Control Centers. For example, in backup power systems, the diesel generator control panel, including the relays inside the panel, would be considered part of the backup power system. If the control panel is determined to be HSS in the FPIE PRA, which is very likely since backup power is important to response of the plant to accidents, then the components in the control panel would be considered HSS by default as part of the HSS function. If a subsequent detailed categorization evaluation of the components in the control panel was performed in accordance with NEI 00-04 [2], then the function of the components in the control panel would be evaluated based on their contribution to successful performance of the control panel function. Therefore, relays that contribute to successful performance of the control panel function, or where intermittent chatter could prevent successful performance, in supporting backup power, would be categorized as HSS.

IFVi IlFVij CDFj)

LjCDFj IlRAWij -

)

CDFj LjCDFj

Proposed Approach 2-6 2.2.3 Summary/Conclusion/Recommendation For Tier 1 plants, the GMRS is either very low or similar to the SSE such that unique seismic categorization insights are expected to be minimal. At the low seismic hazard sites in Tier 1, the likelihood of identifying a unique seismic condition that would cause an SSC to be designated HSS is very low. Therefore, with little to no anticipated unique seismic insights, the 50.69 categorization process using the FPIE PRA and other risk evaluations along with the Defense-in-Depth and qualitative assessment by the Integrated Decision-making Panel (IDP) are expected to adequately identify the safety-significant functions and SSCs required for those functions and no additional seismic reviews are necessary for 50.69 categorization.

2.3 Tier 2 - Moderate Seismic Hazard / Moderate Seismic Margin Sites 2.3.1 Description of the Approach For Tier 2 plants, the GMRS to SSE comparison is higher than Tier 1 plants but not high enough to be treated as Tier 3 plants. In Tier 2, there may be a limited number of unique seismic insights appropriate for consideration in determining HSS SSCs. These insights would be most likely attributed to the possibility of seismically correlated failures or seismic interaction related failures, not identified in the FPIE or Fire PRAs. Therefore, a special sensitivity study is recommended using a Common Cause approach in the FPIE PRA to account for similar categorization insights. These seismic insights would be considered with the other categorization insights by the Integrated Decision-making Panel (IDP) for the final HSS determinations.

The seismic insights from the four seismic categorization test cases are described in Section 3.

One of the key seismic insights is the importance of considering seismic correlation effects on the plant risk. The correlated seismic response of SSCs that may occur in a seismic event is not captured in the internal event PRA or the fire PRA. As such, for 50.69 purposes, for Tier 2 plants should consider these seismic correlation insights when performing system categorization.

Through correlated impacts, seismic events can fail both trains of SSCs in a two-train system depending on the seismic capacity and the seismic demand of the SSCs. Current SPRAs typically assign SSCs to be fully correlated when SSCs have the following same or similar conditions:

The same seismic capacity based on similar governing failure modes in the same equipment (for example, anchor bolt tensile failure, functional failure based on testing, or bearing failure)

The same seismic demand based on the location of the equipment (for example, same building, elevation), and similar orientation if the failure is dependent on the earthquake direction.

Proposed Approach 2-7 These seismic failures, referred to as correlated failures, are similar in impact to common cause failures (CCFs) that are typically modeled in an internal events PRA. The importance of the CCF basic events in the internal events PRA may be used to assess the importance of the seismic correlated failures. However, the probabilities of internal event CCF basic events are generally lower than the conditional probabilities of seismic correlated failures at higher ground motion levels. In addition, the internal events PRA may not have a CCF failure mode and basic event for some of the SSCs that may be subject to correlated seismic failures. For example, seismic failure of two tanks may be modeled as correlated failures in an SPRA, but common cause failure of tanks in the internal events PRA is typically screened out due to the very low probability of random occurrence.

Another key insight from the four seismic categorization test cases is that seismic interactions (for example, seismic induced falling, deflections and flooding that affect nearby safety related components) are unique to seismic risk studies and can result in seismic unique insights potentially leading to HSS SSCs.

To better assess the importance of SSCs to seismic event response at Tier 2 plants, the internal events PRA may be used with some modifications and augmented by focused seismic walkdowns to obtain an indication of the importance of SSCs for mitigating seismic events. The process is depicted in Figure 2-3 and the steps are summarized. Note that this process is performed on a system basis, as the 50.69 categorization process is performed for a given system.

1. Identify the set of SSCs within the system to be categorized.

2. Group the SSCs within the system into the classes of equipment and distributed systems used for SPRAs. This format of grouping allows for an efficient assessment from a seismic perspective. Industry documents such as the EPRI 3002000709 [18] and EPRI NP-6041-SL [19] identify the list of these classes. For example, separately group all manual valves, all check valves, all MOVs, all AOVs, all pumps, etc. This will make it easier to screen SSCs in the next step, as well as to see which SSCs already have CCF basic events modeled in the FPIE PRA.

3. Refine the list of SSCs in the system being categorized based on a series of screens to minimize the number of SSCs required to be evaluated as part of this correlation sensitivity study. Note that any/all of these screens can be incorporated into the process and that any order of implementing these three screens is acceptable. These screening decisions may be plant specific and likely will involve cost/benefit decisions in terms of how best to complete the sensitivity study.

a. Screen out inherently rugged components. NEI 12-06 Appendix H [12] provides the following list of inherently rugged components.

i. Strainers and small line mounted tanks ii. Welded and bolted piping iii. Manual valves, check valves, and rupture disks iv. Power operated valves (MOVs and AOVs) not required to change state

Proposed Approach 2-8

b. Screen out SSCs that are not used in safety functions that support mitigation of core damage or containment performance. This will likely already be identified as part of the function definition within the 50.69 categorization process. An example would be a chiller system that maintains the temperature of water in a tank but is not part of the safety function of the tank (for example, provides core inventory). The SSCs in the chiller subsystem can be screened.

c. Screen out from further evaluation the SSCs that have already been identified as being HSS from either the FPIE PRA or HSS from the Integral Assessment. For this screening step, the categorization based on the FPIE PRA and the Integral Assessment would need to have already been completed.

4. Those SSCs screened out in Steps 3a, 3b, or 3c can be removed from the sensitivity study. In addition, SSCs screened out below in Step 5c, 6, or 9 can be removed from further seismic consideration.

5. For system components not screened out in Step 3, perform a seismic walkdown focused on the three activities listed below. The purpose of this step is to identify SSCs that could experience seismic correlated failures or could be subject to seismic interactions that would lead to failure of more than one SSC within the system being categorized. The following elements contribute to identifying these conditions.

a. Assess if the subject SSCs would likely experience correlated failures during a seismic event. Seismic correlation walkdown reviews are performed as part of an SPRA and the guidance associated with performing that correlation walkdown is documented in Appendix A.

b. Assess potential seismic interactions to identify conditions that would be treated as seismic correlated failures and therefore, should be evaluated as common cause failures.

Guidance for this seismic interaction walkdown review is also contained in Appendix A.

c. Screen out SSCs that are determined to be sufficiently rugged such that they would not be significant contributors to seismic risk in an SPRA. This screen focuses on the SSC seismic capacity associated with functional failures and anchorage. The screen can also be applied to identified seismic interactions provided the seismic capacity of the interacting item (for example, block wall) has a seismic capacity that meets the screening level. Appendix B contains a description of the approach recommended for this screening.

6. SSCs that are determined through the walkdown to be of high seismic capacity and not included in seismically correlated groups or correlated interaction groups can be screened out from further seismic considerations since their non-seismic failure modes are already addressed in the FPIE PRA and fire PRA.

Proposed Approach 2-9 Figure 2-3 Seismic Correlated Failure Assessment r ---- - --

1 I

I I

I I

I I

I I

I I

I I

I I

I I

I I

I I

3a SSC is Inherently Seismic Rugged 2

Group SSCs into equipment classes not used in function that mitigates core damage or containment 1 Step 3 screens can be performed in any order 1

Identify SSCs in system to be categorized

-----Yes,--...... --1.i L-------------------------------------------

________ J

~-----No r-------------------------

Sa Identify SSCs Sb considered seismically e------11-------1 Identify seismic interaction failures correlated 4

Screened out from further seismic consideration High Seismic Capacity

=-----Yes-----~--

1 Step 5 evaluations are

performed as part of a

seismic walkdown 7

Add seismic surrogate common cause groups to FPIE PRA 8

Quantify LOOP/SBO and SLOCA events and calculate FV and RAW Importance Measures Yes No SSCs identified for correlation or interaction fai lures

------No-------.i SSCs meet FV or RAW thresholds for HSS

)----No

Proposed Approach 2-10

7. Add new seismic surrogate events to the FPIE PRA logic model for the potential seismically correlated conditions identified in the previous steps. New surrogates should be added to the PRA under the appropriate areas in the logic model. For example, a new surrogate basic event that models seismic correlated failure of two tanks would be added to the PRA logic model under the gates that model the individual tank failures. Seismic interaction surrogate events should be added to the model such that they fail the SSCs affected by the interaction.

For example, a seismic interaction surrogate event that models a block wall falling onto two nearby pumps should be added to the PRA logic model under the gates that model the pumps.

The probability for the new seismic surrogate basic events should be set to a value equivalent to a typical total seismic hazard exceedance frequency above which SPRAs would typically model loss of offsite power and for which correlated failures may be likely. The recommended value is 1.0E-04, but other appropriately justified values may be used.

8. Quantify the FPIE PRA model for LOOP and small LOCA events using the modified model with surrogate events, and calculate importance measures for the seismic surrogate events.

Since the majority of seismic risk in many SPRAs are the LOOP and small LOCA accident sequences, these events represent are the most appropriate events for performing this correlation study. The process is as follows.

a. The recommended event frequency for the LOOP initiator is 1.0 and for the small LOCA initiator is 1.0E-02. The LOOP frequency value of 1.0 is recommended since the probability of the surrogate events (from Step 7) is the total seismic hazard exceedance frequency above which SPRAs would typically model loss of offsite power. The basis for the small LOCA frequency of 1.0E-02 is that seismically-induced small LOCAs require failures that SPRAs show typically occur at much lower frequency than seismically-induced LOOP. Other appropriately justified values small LOCA frequency may be used.

The majority of seismic risk is from the LOOP/SBO and small LOCA accident sequences.

b. Set the frequency for all initiators other than LOOP and small LOCA to 0. Note that many FPIE PRAs have multiple LOOP initiating events (for example, grid centered, switchyard centered, etc.). Only one of these needs to be set to 1.0 in step 8a, above, while all the rest can be set to 0.

c. Since a seismic event that causes a small LOCA is also assumed to cause a LOOP, update the PRA model to account for this. This is typically done by setting a conditional LOOP probability to 1.0, but can be done in any appropriate manner.

d. Many FPIE PRA models credit restoration of offsite power in the LOOP/SBO accident sequences. This credit should not be taken in this process since recovery of offsite power after a seismic event is not generally credited in a seismic event.

9. For each seismic surrogate event, compare the results to the F-V and RAW HSS criteria for common cause components in the FPIE PRA from NEI 00-04 (that is, F-V > 0.005 or RAW > 20). For seismic surrogate events, if the F-V or RAW criteria are met, all SSCs modeled by that surrogate event should be considered HSS.

Proposed Approach 2-11

10. Since this process is a pseudo-deterministic evaluation process rather than a full risk informed process, these seismically correlated group HSS designations should be treated similar to HSS designations using the IPEEE SMA SSEL and in general, not be subject to reconsideration by the Integrated Decision-making Panel (IDP). However, SSCs which are HSS solely due to surrogate events representing seismic induced interactions (for example, block walls impacting equipment) may be downgraded to LSS by the IDP with appropriate justification. In addition, the IDP may direct further engineering evaluation to refine any of the seismic evaluation insights.

2.3.2 Technical Basis for Approach The test cases described in Section 3 showed that even for plants with high seismic ground motions compared to their design basis, there are very few if any SSCs that would be designated HSS for seismic unique reasons and the technical basis for the Tier 1 approach in Section 2.2.2 generally apply for the Tier 2 plants.

The test cases did identify a small number of instances where unique seismic insights associated with seismically correlated failures led to unique HSS SSCs. While these unique HSS SSCs would be unusual for moderate hazard plants, it is prudent to perform additional evaluations to identify the conditions where these correlated failures may occur, and determine their impact in the 50.69 categorization process.

For a system being categorized under 50.69, the process described in Section 2.3.1 identifies the conditions that would be treated as seismically correlated fragilities or interaction consequences if an SPRA were being performed. It screens out SSCs that would either be very low contributors to seismic risk or would not be potential candidates for HSS, or were already categorized as HSS. These SSCs do not require additional seismic evaluations for considerations in the 50.69 categorization process. After that initial work, the evaluation follows a thought process similar to that in a SPRA, using a seismic walkdown to identify correlated conditions and potential seismic interaction and screen low seismic contributors.

The resulting unscreened SSCs are candidates for seismically correlated conditions that should be evaluated for their impacts on 50.69 categorization. In an FPIE PRA, common cause evaluations behave similarly to seismically correlated conditions in that they model the impacts of multiple SSC failures; therefore, the common cause methods can be employed to determine the necessary insights for 50.69 categorization.

The recommended methods and evaluation parameters in Section 2.3.1 for adding the surrogate seismic common cause events into the FPIE PRA and performing the sensitivity study serve to identify to necessary categorization insights. A common cause failure probability of 1.0E-4 is used to align with the total seismic hazard exceedance frequency above which SPRAs would typically model loss of offsite power and for which correlated failures may be likely.

Seismically induced LOOP and small LOCA events represent the majority of seismic risk in many SPRAs and are the most appropriate events for performing this correlation study. The process assumes a LOOP occurs (frequency set to 1.0) and uses a small LOCA frequency of 1.0E-02 because seismically-induced small LOCAs require failures that SPRAs show typically occur at much lower frequency than seismically-induced LOOP. This combination of events typically encompasses the majority of seismic risk.

Proposed Approach 2-12 The importance measures derived from this sensitivity study can then be used to identify the appropriate SSCs that should be HSS due to seismically correlated failures or seismic interaction related failures.

2.3.3 Summary For Tier 2 plants, the GMRS to SSE comparison is higher than Tier 1 plants but not high enough to be treated as Tier 3 plants. In Tier 2, there may be a limited number of unique seismic insights, most likely attributed to the possibility of seismically correlated failures, appropriate for consideration in determining HSS SSCs. The special sensitivity study recommended using common cause failures, similar to the approach taken in a FPIE PRA, can identify the appropriate seismic insights to be considered with the other categorization insights by the Integrated Decision-making Panel (IDP) for the final HSS determinations.

2.4 Tier 3 - High Seismic Hazard / Low Seismic Margin Sites For Tier 3 plants, the GMRS to SSE comparison is high enough that no alternate approach for seismic inputs to the 50.69 categorization process is proposed and the existing processes identified in NEI 00-04 for considering seismic risk in the categorization process should be used.

The four seismic categorization test cases described in Section 3 suggest that even for Tier 3 plants, only a limited number of seismic unique insights are likely to contribute to the categorization process. However, in Tier 3 the potential GMRS seismic demands exceed the seismic design bases by high enough ratios that it is difficult to have high confidence that unique seismic conditions would not affect the set of SSCs captured in the categorization process.

Therefore, the available methods in NEI 00-04 can be used to provide seismic inputs to the categorization process. These methods include the use of an SPRA or an SMA as described in Section 5.3 of NEI 00-04 [2].

3-1 3

SEISMIC PRA INSIGHTS AND TRIAL CATEGORIZATION STUDIES CONDUCTED ON HIGH SEISMIC HAZARD SITES Trial 50.69 categorization evaluations were performed at four plants with relatively high seismic hazards using the SPRAs available for these plants. These plants were characterized as having and high seismic hazards, based on the ground motion response spectrum (GMRS), compared to their seismic design bases, defined by the safe shutdown earthquake (SSE). These trial characterizations were undertaken to determine the seismic related categorization insights. Those seismic insights are compared with categorization insights at the same plants using their FPIE PRAs and fire PRAs if available to determine the degree to which the seismic insights produce unique categorization insights. The trial studies were not performed to implement actual SSC 50.69 categorization and did not include the NEI 00-04 criteria for the IDP. The trials were performed to derive seismic related categorization insights in support of this report.

3.1 Introduction to Trial Categorization Studies Sensitivity studies were performed at four sites with newly developed SPRAs. The selected sites represent a distribution of different reactor types, containment types, and nuclear steam supply system (NSSS) types as shown in Table 3-1.

Table 3-1 Trial Plant Summary Pilot Plant MWe (Unit 1 / Unit 2)

NSSS Type Containment Type Plant A 1180 / 1180 Wetwell)

Plant 1000 / 1000 Westinghouse / 3-loop Large Dry, Subatmospheric Plant C Westinghouse / 4-loop Large Dry Plant D 1000 / 1000 Westinghouse / 4-loop Wet, Ice Condenser As described in Section 2.1, the degree to which the plant seismic hazard (GMRS) exceeds the seismic design basis (SSE) is expected to influence the likelihood that unique seismic-related HSS SSCs will be identified. At higher seismic hazard plants, the chances of identifying an unusual seismic induced condition that would cause SSCs to be HSS is greater. Therefore, 50.69 seismic categorization test cases performed using plants with high GMRS relative to their SSE would be more likely to identify unique conditions that would lead to the identification of HSS SSCs for unique seismic related reasons.

The GMRS to SSE comparisons at the four trial plants are shown in Figures 3-1 through 3-4. In each case, the GMRS exceeds the SSE by a significant margin.

GE/BWR4 Mark I (Steel Drywel and B

1150 / 1150

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-2 Each trial is described in the following sections.

Figure 3-1 Plant A Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison Figure 3-2 Plant B Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison 1.40 I I I 1.20 '-

SSE 1.40 1.20 1.00

§ 0.80

~

~

Q)

] 0.60 u

<t 0.40 0.20 0.00

0. 10 I

I SSE GMRS

-1

~

I I

I l -

I I I I

I I

~~

4 I

~-

/ +

I V

I

~H-I j

I I

l I~ I I I I j

I I I I

+-+-'-

/

/ (

V_/t 1.0 0 10.00 Frequency (Hz)

I I I

'.l I

I I

\\

I I I~ I I. rs I

100.00

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-3 Figure 3-3 Plant C Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison Figure 3-4 Plant D Ground Motion Response Spectrum to Safe Shutdown Earthquake Comparison 1.40 1.20 1.00

§ 0.80

~

a, "ii 0.60 u

u

<(

0.40 0.20 0.00 1.40 1.20 1.00

§ 0.80

~

a, "ii 0.60 u

u

<(

0.40 0.20 I

I f-SSE

~

GMRS

~

V I~

~

~

I -

0.10 ssE GMRS I

j I

I I +

I I

I I I I

I I

.. If" ~~

I

~ \\.

-~

I I I I

I I I I

I

\\

j I

\\

/,_

'\\.

H -rl,~ i -++--

'l I

r-

~

i---

y

"'J

-I -r-

~

I I"

~

I L +

L 1.00 10.00 100.00 Frequency (Hz)

I I

I I

I I

I I

I I

I I

I I

I I

I i

I.. ~

I 1., ~

~,

11 --

1.1~ l --

\\j 1--

1\\...

,r

,., ~.

/

/

.. !Iii ~

7 ~

~V,_,,/_

I I

~--*1 V I

I 0.00 0.10 1-rT I I -

1.00 10.00 100.00 Frequency (Hz)

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-4 3.2 Plant A Trial Categorization Evaluation 3.2.1 Introduction Plant A is a two-unit plant. Each unit has a GE BWR 4 Reactor and Mark I Containment. The initial plant design was 3458 MWt and 1180 MWe per unit. Plant A has implemented various power uprates (Leading Edge Flow Meter, Extended Power Uprate and Measurement Uncertainty Recapture) yielding current ratings of 4016 MWt and 1366 MWe, per unit.

The PRA models used in this study are described below.

3.2.2 Seismic PRA High Safety Significant Evaluation 3.2.2.1 The risk-informed categorization of SSCs in nuclear power plant applications requires the use of an appropriately detailed PRA of sound technical quality. Plant A has a preliminary SPRA that is of sufficient quality to support this study. It was Peer Reviewed in March 2017 and is scheduled to be submitted to the NRC in 2018 in response to the Fukushima 50.54f letter [6]. This section will describe how the quantitative insights from the SPRA model are developed for this study.

3.2.2.2 Description of Model Used for Analysis The SPRA models used for this analysis provided seismic insights into the as built, as operated plant. The risk significance of each identified component was examined using the SPRA. This evaluation consisted of examining the results from each unit for both core damage frequency (CDF) and large early release frequency (LERF). The single top SPRA model was created and quantified using the EPRI R&R Workstation software suite [20], with truncation values ranging from 1E-06/yr to 1E-10/yr for CDF and truncation values ranging from 5E-8/yr to 1E-12/yr for LERF. The seismic PRA uses a discretized set of seismic intervals to represent the full seismic hazard, evaluates the seismic CDF and LERF for each seismic interval, and integrates the results over the set of seismic intervals. Due to the special circumstances within seismic modeling (that is, over-counting caused by numerous high failure probability events), the EPRI Advanced Cutset Upper Bound Estimator (ACUBE) code [21], which uses the Binary Decision Diagram (BDD) algorithm, is used for more accurate quantification of the SPRA model.

The risk importances are calculated using cutset results (as typical in an R&R Workstation environment) and the ACUBE software to determine the individual basic event risk importance values. The seismic CDF (SCDF) Fussell-Vesely (F-V) values for SSC fragilities are calculated by integrating the various seismic interval basic event risk importances to determine the risk importance for a given SSC. The SCDF F-V values are based on a weighted sum of the individual SSC F-V values calculated for the individual seismic hazard intervals. In other words, the total F-V of an SSC fragility is the weighted sum of the associated eight SSC fragility basic events (one per hazard interval). Similarly, the SCDF risk achievement worth (RAW) risk importance measures are integrated for all eight basic events. This is typically performed manually in an Excel spreadsheet using the ACUBE output importance information. The seismic LERF (SLERF) F-V and RAW values are calculated using the same method discussed for SCDF.

Background

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-5 Similar to Internal Events, the component importances were evaluated using the methodology described in NEI 00-04 [2] and the importance calculation criteria identified in Table 5-1 of NEI 00-04. The determination of High Safety Significant (HSS) or Low Safety Significant (LSS) from the SPRA is described in Section 3.2.5.

3.2.3 Full Power Internal Events PRA High Safety Significant Evaluation The Plant A full power internal events (FPIE) PRA model was Peer Reviewed in November 2010. It models severe accident scenarios resulting from internal initiating events occurring at full power operation as required to support the 50.69 categorization process. The results of the Internal Events quantification are used as one of the inputs in the 50.69 categorization process.

This section describes how the quantitative insights from the Plant A Internal Events model are developed and used for categorization.

3.2.3.2 Description of Model Used for Analysis The FPIE PRA models used for this analysis were 50.69 application specific models, adjusted to provide better insight into the as built as operated plant.

The risk significance of each identified component was examined using the FPIE PRA. This evaluation consisted of examining the results from both units for both CDF and LERF. While quantifying the FPIE PRA model using the EPRI PRAQuant Software [22], truncation values for CDF and LERF were both 5E-12. The component importances were evaluated using the methodology described in NEI 00-04 [2] and the importance calculation criteria identified in Table 5-1 [2]. The Determination of HSS or LSS from the Internal Events PRA is described in Section 3.2.5.

3.2.3.3 Identif NEI 00-04 [2] provides the following guidance.

An essential element of the SSC categorization process is a plant-specific full power internal events PRA, which should satisfy the accepted standards for PRA technical adequacy, reflect the as-built and as-operated plant, and quantify core damage frequency (CDF) and large early release frequency (LERF) for power operations due to internal events. Assessments of other hazards and modes of plant operation should be reviewed to ensure that the results and/or insights are applicable to the as-built, as-operated plant.

PRAs provide an integrated means to assess relative significance. In cases where applicable quantitative analyses are not available, the categorization process will generally identify more SSCs as safety-significant than in cases where broader scope PRAs are available.

For the purposes of this analysis a full system mapping was not needed as only specific components, identified as HSS by the SPRA were evaluated. In practice a complete system mapping would be performed for the system being evaluated.

Per the NEI 00-04 process, a number of PRA risk significance evaluations are performed to determine the risk significance of PRA-modeled components. In order to perform the PRA risk significance evaluations a mapping of system components to PRA basic events (for example, 3.2.3.1 Background ication of Risk Criteria and Analysis of Component Importances

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-6 pump fails to start, pump fails to run) would be performed. Typical events that are included in the mapping are events representing independent component unreliability, unavailability and common cause failures. Some components may not be explicitly modeled in the PRA however, surrogate events, such as operator actions may be used to provide insights into a components significance.

Basic event component mapping was performed consistent with the 50.69 categorization process.

Each component was evaluated using two PRA importance metrics, Fussell-Vesely (F-V) and Risk Achievement Worth (RAW). Table 3-2 [2] lists the high-level criteria for risk significance of PRA modeled components. Common cause failure (CCF) contribution is included in the evaluation using a separate metric as defined in the table. Per the NEI 00-04 [2] guidance, for each PRA risk significance evaluation discussed below, the PRA F-V values for each basic event are added together for a given component; the maximum value of RAW for each basic event is selected for a given component; and the maximum value of common cause RAW for each basic event is selected for a given component. If a component exceeds any of the HSS criteria, the component is preliminarily categorized as HSS. The evaluation was performed in accordance with Section 5 of NEI 00-04.

Table 3-2 PRA Risk Criteria per NEI 00-04 PRA Ranking NEI 00-04 Criteria HSS Sum of F-V for all basic events modeling the component of interest, including HSS HSS vents RAW values >20 LSS Modeled SSCs that do not meet any of the HSS criteria 3.2.4 Fire PRA High Safety Significant Evaluation The Plant A Fire PRA was used to perform the 50.69 categorization process evaluation. The model was Peer Reviewed in November 2011 and the F&O Finding Closure Review was conducted in November 2016. This section describes how the quantitative insights from the fire model are developed and used for categorization.

3.2.4.1 Description of Model Used for Analysis The Fire Models used for this analysis were application-specific models adjusted to provide better insight into the as built, as operated plant.

The risk significance of each identified component was examined using the Fire PRA, using the results from both units for both CDF and LERF. While quantifying the Fire PRA model using the EPRI PRAQuant Software [22], truncation values for CDF and LERF were both 5E-12.

Similar to the FPIE PRA, the component importance measures were evaluated using the methodology described in NEI 00-04 and the importance calculation criteria identified in Table 3-2. The determination of HSS or LSS from the Fire PRA is described in Section 3.2.5.

common cause events >0.005 Maximum of component basic event RAW values >2 Maximum of applicable common cause basic e

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-7 3.2.4.2 sis of Component Importances The same criteria and methodology as described in Section 3.2.3.3 (FPIE PRA) was also used to determine a components safety significance with respect to the Fire PRA.

3.2.5 Comparison of Seismic PRA Results to Other PRA Results for High Safety Significant Structures, Systems, and Components Each seismic failure event (fragility group) in the SPRA that exceeded the HSS thresholds was evaluated to determine if the same HSS determination would be made from either the FPIE PRA, FPRA or both. The HSS numerical criteria from Table 3-2 were applied to all PRAs used in this study. Table 3-5 provides the results of this comparison.

As described in earlier sections some components can be explicitly represented in the PRA by using basic events that represent either unreliability or unavailability of the SSC. For the purposes of this study, some of the seismic failure event identified as being HSS from the SPRA were explicitly modeled in either the Internal Events PRA, Fire PRA or both. These fragilities are shown in Table 3-3.

Table 3-3 Seismic Fragilities Addressed by Explicit Modeling Fragility Group Description OSP Offsite Power S-Nearby Hydroelectric Plant (Offsite Power Source)

S-ACPA1-S-

S10-S-

-D)D13 S-DC Panel 20D24, 30D21 S-

-D)D01, 3(A-D)D01 SCRAM RPV Internals (Scram)

SML Seismic Induced Medium LOCA S-PCI2 Primary Containment Isolation (Inboard and Outboard MSIVs)

Implicit Modeling As described in earlier sections some components can be implicitly represented in the PRA by using basic events such as super components or operator actions as examples. For the purposes of this study, some of the seismic failure events (fragility groups) identified as being HSS from the SPRA were implicitly modeled in either the FPIE PRA, the Fire PRA or both. The Identification of Risk Criteria and Analy 3.2.5.1 Explicit Modeling NRBY2 120 VAC Bus 00Y03 DCB 250 VDC Bus 30D11 DCBS2 125 VDC Buses/MCCs 0(A DCBS4 DCBT1 DC Batteries 2(A BOC Break Outside Containment 3.2.5.2

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-8 methodology for choosing the implicit modeling for each of the seismic failure events of interest is summarized in Table 3-4.

Table 3-4 Seismic Fragilities Addressed by Implicit Modeling Seismic Fragility Group Description of Fragility Implicit Modeling S-CC014 p

Unrecoverable)

This is a correlated relay group. Some of the relays within this group However, the relays supported are modeled in the FPIE PRA and Fire PRA and are HSS. The failure of the was used as a surrogate to bound the relay categorization.

S-CC023 Unrecoverable)

Similar to S-CC014, this fragility is a correlated relay group.

icitly modeled but some are not. However, the relays supported busses are modeled in the FPIE PRA and Fire PRA and are HSS. The failure of the was used a surrogate to bound the relays categorization.

S-E1-(A-D)T40 in the FPIE or Fire PRA models.

which are HSS in both the FPIE and Fire PRA models and would Additionally, b be modeled in the same function during the categorization process, therefore since the are HSS in the FPIE PRA model, so would the S-CC127A and C-Recoverable)

Failure of this group leads to the failure of the DIV 1 and For this reason, the relays were implicitly S-CC187 Relay Chatter Event Recoverable via operator action)

Failure of this group leads to failure For this reason, the relays were implicitly mapped to the failure S-CC191 Relay Chatter Event recoverable via operator action)

Failure of this group leads to failure For this reason, the relays were implicitly mapped to the failure S-CC211 Relay Chatter Event 211 (HPCI -

recoverable via operator action) modeled; however, failure of the components lead to failure of the HPCI Pump. For that reason, the components are considered HSS by implicitly mapping them to the failure of the HPCI Pump.

Correlated Relay Grou are explicitly modeled but some are not.

14 (All 4KV Buses 4 kV busses 4 kV busses Correlated Relay Group Some of the relays within this fragility are expl 23 (All 4KV Buses 4 kV 4 kV busses The fuel oil tanks are not specifically modeled However, they support the EDGs DGTK2 E4 EDG Fuel Oil be implicitly mapped to the failure of the EDGs.

Day Tank O oth the EDGs and EDG fuel oil tanks would EDGs fuel oil tanks.

Correlated Relay Group 127 and 157 (EDG A DIV3 EDGs.

mapped to the failure of their impacted EDG.

187 (EDG B of the DIV 2 EDG.

of their impacted EDG.

191 (EDG D of the DIV 4 EDG.

of their impacted EDG.

The relays associated with this group are not explicitly

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-9 Table 3-4 (continued)

Seismic Fragilities Addressed by Implicit Modeling Seismic Fragility Group Description of Fragility Implicit Modeling S-CC229 Relay Chatter Event 229 (RCIC inboard isolation valve) modeled; however, failure of the components lead to failure of the RCIC Inboard Isolation Valve. For that reason, the components are considered HSS by implicitly mapping them to the failure of the RCIC Inboard Isolation Valve.

S-CC230 Relay Chatter Event 230 (RCIC -

recoverable via operator action) plicitly modeled however, failure of the components lead to failure of the RCIC Pump. For that reason, the components are considered HSS by implicitly mapping them to the failure of the RCIC Pump.

S-CNCT1 Condensate Storage (CST) 20T010 and 30T010 Failures of the the FPIE and Fire PRAs however, the failure probability is so low that the events truncate out of the cutsets. The actions. The operator action to refill the CST was used to gain an insight into the importance of the CST as this action did not truncate out of the cutsets. This action was determined to be HSS.

S-Similar to the S-modeled in the FPIE PRA but is LSS due to the low probability of failure.

represented by operator actions. The operator action to a

t cate out of the cutsets. The dependent operator actions were S-CEPA1 Panel 20C003, 20C004C, 30C003, 30C004C, 00C29(A-D)

The p FPIE PRA models but the panels support numerous components which are modeled as basic events in the PRA model.

Many of the basic events modeling the supported components are HSS. For this reason it can be determined that the panels associated with this fragility group are also HSS.

3.2.6 Analysis and Conclusions Examination of the Plant A SPRA, FPIE PRA and Fire PRA information and results in Table 3-5 shows that all SSCs or correlated fragility groups that are HSS in the SPRA are also HSS in the FPIE PRA or Fire PRA or both. This is shown graphically in Figure 3-5. There are 23 fragility groups in the SPRA that meet the F-V or RAW criteria for HSS. Of those 23 groups, 22 would also be identified as HSS in the FPIE PRA, 17 would be HSS in the FPRA, 12 would be HSS from implicit modeling, and five would be HSS from passive categorization considerations.

The relays associated with this group are not explicitly The relays associated with this group are not ex condensate storage tanks are modeled in Tank tanks can also be implicitly represented by operator CNCT1, the SGIG tank is explicitly The tank can also be implicitly SSGTK1 SGIG Nitrogen Tank lign the tank was used to gain an insight into the importance of the SGIG ank as this action did not trun also used to determine the safety significance of the SGIG tank.

anels are not modeled explicitly in the

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-10 Every SSC that is HSS due to seismic considerations would also be HSS for other considerations and there are no HSS insights uniquely due to seismic.

The Plant A HSS SPRA SSCs are bounded by the HSS SSCs in the FPIE PRA or Fire PRA or both. No exceptions or outliers were identified.

Figure 3-5 High Safety Significant Structures, Systems, and Components for Plant A FPIE HSS 1,650 Seismic HSS 469*

.. SPRA HSS SSCs include 185 control rods and 185 hydraulic control units that are HSS

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-5 Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of System Fragility Fragility Failure Comments Group Group Component Component Mode of Description ID SSC Generic Fragility (for

example, OSP Offsite Power ceramic Anchorage insulators in plant switchyard)

Correlated Relay Group Contact Device Relays in Bay S-CC014-14 (All 4KV CRL SI-Functional Buses Overcurrent 8, B Emergency Unrecoverable)

Power Correlated Relay Group Contact Device Relays in:

S-CC023-23 (All 4KV CRLs Bay 2, Bay4 Functional

Buses, Bays Recoverable)

Generic Fragility (for Nearby

example, S-NRBY2-Hydroelectric ceramic Anchorage Plant (OSP) insulators in Nearby Dam switchyard) 3-11

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 5 (continued)

Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of System Fragility Fragility Failure Comments Group Group Component Component Mode of Description ID SSC The fuel oil tanks are not specifically modeled in the FPIE and Fire PRA models.

However, they support the E1-E4 EOG EDGs which are HSS in both 0AT040 the FPIE and FPRA models.

S-DGTK2-Fuel Oil Day EOG Fuel Oil 0BT040 Anchorage Both the EDGs and EOG fuel Tank 0(A-Day Tanks D)T40 0CT040 oil tanks would be modeled in the same function during the categorization process and therefore the EDGs being HSS in the PRA model would drive the fuel oil tanks HSS.

Emergency S-ACPA1-120VAC Bus 120 VAC Bus 00Y03 Anchorage Power 00Y03 Correlated 0-528-132-Relay Group Contact Device AG12 S-CC127A-127 and 157 Functional (EOG A and C-CRLs 0-528-132-Recoverable)

CG12 Relay Chatter S-CC187-Event 187 Contact Device 0-528-132-Functional (EOG 8-CRL BG12 Recoverable)

Relay Chatter S-CC191-Event 191 Contact Device 0-528-132-Functional (EOG D-CRL DG12 Recoverable) 3-12

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 5 (continued)

Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments System Fragility Fragility Component Component Failure Group Group Mode of Description ID SSC DC Power S-DCBS10-250VDC Bus 250VDC HPCI 30D11 Anchorage System 30D11 BUS 125 voe

0AD013, 125 voe

0BD013, Functional S-DCBS2-Buses/MC Cs Buses/MC Cs

0CD013, 0(A-D)D13 0DO013 Most DC buses are DC Power DC Batteries individually HSS and CCF of Systems 2(A-D)D01, 125 voe 3AD01 Anchorage all are HSS in both FPIE and S-DCBT1-Battery 3(A-D)D01 FPRA (EBS13ALLCWI0).

S-DCBS4-DC Panel 125 voe 20D24 Anchorage 20D24, 30D21 Panel Relay Chatter Event 211 Contact Device 2-23A-K036 Functional S-CC211-(HPCI -

CRL recoverable)

Relay Chatter Event229 Safety (RCIC inboard Contact Device 2-13A-K012 Functional Injection S-CC229-isolation CRL valve - Unre-coverable)

Relay Chatter Event230 Contact Device 2-13A-K022 Functional S-CC230-(RCIC-CRL recoverable) 3-13

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 5 (continued)

Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments System Fragility Fragility Component Component Failure Group Group Mode of Description ID SSC Reactor RPV Internals RPV core Protection SCRAM (Scram) shroud leg Anchorage System Onsite Condensate HSS due to operator action to Storage Tank Condensate

20T010, Water S-CNCT1-

20T010, Storage Tanks 30T010 Anchorage align to the CST Sources 30T010 RCS piping THE BOC Initiating Events outside are HSS but a review of the BOC Break Outside containment Anchorage components involved has Containment (for example, also been performed to Main Steam identify any HSS individually Lines)

Piping RCS piping inside Seismic containment Medium LOCA is HSS in the SML Induced (for example, Anchorage Internal Events Model Medium LOCA between 2" and 6" diameter)

SGIG Tank is not HSS Safety CAD Liquid Explicitly but it is HSS due to Grade S-SGTK1-SGIG Nitrogen Nitrogen 00T116 Anchorage implicit modeling in operator Instrument Tank Storage Tank actions (AHU--CADDXD2, Gas AHU--CADDXl3) 3-14

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 5 (continued)

Sensitivity Study Results for Plant A Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of System Fragility Fragility Failure Comments Group Group Component Component Mode of Description ID SSC The Panels are not modeled explicitly in the Panel 20C003, PRA models but the panels

20C004C, 00C29A, support numerous MISC S-CEPA1-

30C003, Panels

00C29B, Anchorage components which are Panels

00C29C, modeled as basic events in

30C004C, 00C29D the PRA model. Many of 00C29(A-D) the basic events modeling the supported components are HSS.

AO-2-01-086A AO-2-01-0868 Primary AO-2-01-086C Containment Mapped to FPH--MSTDXl2.

Contain-S-PCl2 Isolation Outboard AO-2-01-086D Functional MSIVS Fail to Remain ment (Inboard and MSIVs AO-3-01-086A Open During Transient.

Outboard AO-3-01-0868 Also HSS due to %VMSL MSIVs)

AO-3-01-086C AO-3-01-086D 22 17 12 5

Totals 23 23 Seismic Fragility 0

Groups classified as HSS via overlapping 50.69 criteria 3-15

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-16 3.3 Plant B Trial Categorization Evaluation This section documents the sensitivity performed using the Plant B SPRA.

3.3.1 Introduction Plant B is a two-unit Westinghouse PWR (three loop) site with a large, dry sub-atmospheric containments and approximately 1,000 MWe each. They entered commercial operation in 1978 (Unit 1) and 1980 (Unit 2). Water from an adjacent lake is used to cool the main condensers.

Emergency core cooling is accomplished by three High Head Safety Injection (HHSI) pumps and two Low Head Safety Injection (LHSI) pumps. The HHSI pumps also provide normal Charging and Reactor Coolant Pump (RCP) seal injection during non-accident conditions. There are two Emergency Diesel Generators (EDGs) that power the two emergency buses if offsite power is lost. There are four 120 VAC vital buses (two per emergency bus) powered by either the batteries/inverters (four total) or directly from the emergency buses through transformers.

Three Auxiliary Feedwater (AFW) pumps (two motor-driven and one turbine-driven) provide steam generator cooling if the main Feedwater pumps are unavailable. The ultimate heat sink is from the 22.5 million-gallon Service Water reservoir, where four pumps provide SW flow to both units via two headers. Two auxiliary SW pumps that take lake water suction are also available to provide SW to the station.

3.3.1.1 PRA Models The FPIE PRA and SPRA models contain logic for quantifying CDF and LERF for each unit.

For this sensitivity, the results are from the Unit 1 PRA models only. The results for Unit 2 would be similar given that both units are nearly identical.

The Plant B SPRA model was developed from the latest FPIE PRA. That is, seismic fragility groups that model seismic failure of the SSCs were added to the appropriate locations in the fault trees. The accident sequences that model the various seismic-induced initiating events (LOCAs, SBO, etc.) were developed from the FPIE PRA accident sequences. The SPRA has top gates (Ux-CDF-SEISMIC and Ux-LERF-SEISMIC) which are quantified using the EPRI PRAQuant code. The cutsets are then processed using ACUBE to obtain the final seismic CDF and LERF as well as the importance data.

The FPIE PRA underwent a full scope peer review in 2014. The FPIE model has been revised to address all F&Os that impact model logic. The remaining F&Os are for documentation improvements and are not expected to impact the results. These were reviewed as part of the development of the SPRA to verify no impact on the SPRA results.

The SPRA model used for this sensitivity was peer reviewed in July 2017. The SPRA model is in the process of being revised to address the F&Os. The results of this sensitivity are not expected to be impacted by these F&Os.

The following three upgrades have been incorporated into the FPIE and SPRA models. The first upgrade is credit for FLEX in the Station Blackout (SBO) sequences has been added to both the FPIE and SPRA models. The FLEX mitigating actions modeled are load shedding the batteries and aligning the FLEX 120VAC generators to power the vital AC buses and maintain instrumentation. Also, the FLEX mitigating action to align the FLEX RCS Injection Pump for

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-17 RCS makeup from the RCP seal leakage is modeled in the SBO sequences. This upgrade was peer reviewed in July 2017 as part of the SPRA peer review. The review team determined that the FLEX modeling was appropriate but identified that the uncertainties relating to Human Reliability Analysis of the FLEX actions and the failure data of the FLEX SSCs should be investigated further. Sensitivities will be included in the final SPRA submittal. The team also recommended improvements in the documentation of the FLEX modeling. The results of the SPRA are not expected to be impacted by these F&Os.

The second upgrade involves using a convolution approach to modeling recovery of offsite power in the SBO sequences. This is only applicable to the FPIE model since the SPRA SBO sequences do not credit offsite power recovery.

The third upgrade involves the replacement of the Reactor Coolant Pump (RCP) seals with the low leakage Flowserve N-9000 seals. The final RCP seal was replaced in March 2018.

Therefore, the SPRA credits the Flowserve RCP seal LCOA model (that is not the Westinghouse seal LOCA model). This is upgrade has not been peer reviewed at this time but will be scheduled in 2018. The Flowserve seal LOCA model used in the Plant B FPIE and SPRA model is essentially the same as the logic used in a nearly identical plant FPIE PRA model that had a focused peer review of the upgrade in 2016. Since the PRA models for both plants are developed and maintained by the utility PRA group using the same procedures and methods, the RCP seal LOCA models are nearly identical. The F&Os from the nearly identical plant focused scope peer review of the RCP seal LOCA model were reviewed and verified to not impact the results of the Plant B SPRA.

3.3.2 Seismic PRA High Safety Significant Evaluation This section contains a summary of the SPRA Model and identification of HSS SSCs from the SPRA.

3.3.2.1 Description of Seismic PRA Model The SPRA is integrated into the FPIE PRA by adding seismic failure gates under the appropriate portions of the logic model that model the other failures of the SSCs (for example, pump failing to start). Seismic failures of SSCs are modeled using fragility groups, which represent failure of groups of SSCs, typically both (multiple) trains if the SSCs are assumed to be correlated. Most of the SSCs are assumed to be correlated given similar design, location, and configuration. For example, both Low Head Safety Injection (LHSI) pumps, 1-SI-P-1A &1B, are assumed to be correlated because they are both located in the Safeguards building, are of similar design and are installed in the same configuration. Therefore, seismic failure of these pumps is modeled using fragility group SEIS-SI-P-1AB, which is placed in the logic model under the gates for both LHSI pumps.

The seismic hazard curve is divided into eight intervals and is modeled by eight seismic initiating basic events %G01 through %G08. Each fragility group is therefore modeled by eight seismic failure basic events representing the probability of failure for each of the eight seismic intervals of the seismic hazard curve. The seismic failure basic events in the LHSI pump fragility group are SEIS-SI-P-1AB-C-%G01 through SEIS-SI-P-1AB-C-%G08.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-18 The SPRA model is quantified using EPRI PRAQuant to generate the cutsets, which are then processed with ACUBE [21] that uses the Binary Decision Diagram (BDD) to obtain a more accurate solution that reduces the overestimation that occurs when basic event probabilities are high. The model was quantified using truncation limits of 1.0E-09 and 1.0E-10 for SCDF and SLERF, respectively. ACUBE allows processing a subset of cutsets using the BDD since computer memory typically limits the number of cutsets that can be processed. The remaining cutsets are then processed by the factored-minimum cutset upper bound (F-MCUB) routine.

ACUBE combines these to obtain the final SCDF and SLERF as well as their importances. For Plant B, 2,000 cutsets were processed for the SCDF importances and 1,500 cutsets were processed for the SLERF importance.

ACUBE generates Fussell-Vesely (F-V) and Risk Achievement Worth (RAW) importance data for each basic event or fragility group in the cutsets. Both F-V and RAW are used to obtain the importance of the fragility groups. The same approach used by Plant A was used for Plant B in combining the importances of each of the eight seismic failure basic events to obtain the importance of the fragility group.

3.3.2.2 Identification of HSS SSCs from the SPRA Fragility groups are considered High Safety Significant (HSS) if the group F-V is greater than 0.005 or if the group RAW is greater than 2.0 for CDF or LERF. Thus, if a group has a SCDF (SLERF) F-V or RAW that meet these HSS thresholds, then the SSCs in the group are considered HSS. In the example of the LHSI pump fragility group, SEIS-SI-P-1AB, both 1-SI-P-1A and 1-SI-P-1B pumps would be considered HSS if the fragility group SCDF (SLERF) F-V or RAW meet the HSS threshold.

The SPRA also models non-seismic failures (for example, failure to start, run) of SSCs that can impact mitigating functions. Only two SSCs, the diesel-driven fire pump (1-FP-P-2) and the FLEX 120VAC generator (0-BDB-GEN-1A) have F-V importance greater than 0.005. The remaining basic events that model the non-seismic failures have F-Vs and RAWs that are less than the thresholds for HSS.

The results from the SCDF and SLERF quantification and importances show that 36 fragility groups and two non-seismic failure basic events are considered HSS. Table 3-7 lists these fragility groups and basic events. The SSCs that are modeled by these fragility groups are also listed in the table. There are over 200 SSCs within these fragility groups that are considered HSS for seismic risk.

3.3.3 Full Power Internal Events PRA High Safety Significant Evaluation In the FPIE model, failure of SSCs are modeled for the different failure modes, such as pumps, fans, compressors, etc. failing to start, failing to run, failure to load, and out of service for test or maintenance. Additional failure modes may be modeled depending on the component. Common cause failures of the components are also included in the FPIE to account for possible design, maintenance and latent defects that could be common between similar components within the trains.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-19 These SSC failures are modeled as basic events in the FPIE model. There are over 2800 basic events in the Plant B unit 1 FPIE PRA that model over 1300 SSCs. The FPIE PRA is quantified using the EPRI PRAQuant software [22] to obtain the CDF and LERF cutsets. The truncations selected for these meet the PRA Standard for acceptable truncation. For CDF, a truncation of 1.0E-12 was used, while a truncation of 1.0E-13 was used for LERF. The importances are obtained from the cutsets directly (that is ACUBE is not used). A component is considered HSS if the sum of the CDF (LERF) F-Vs of the failure modes for the component is greater than 5.0E-03, or if any failure mode CDF (LERF) RAW is greater than 2.0. A common cause failure basic event is considered HSS if the CDF (LERF) RAW is greater than 20. Of the 1300 SSCs, approximately 380 are HSS. The 50.69 categorization for Plant B using the FPIE importances has not been completed at this time. Therefore, the importance data is taken from the latest PRA input to the Maintenance Rule risk ranking and the latest FPIE PRA quantification results.

3.3.4 Fire PRA High Safety Significant Evaluation Plant B does not have a Fire PRA at this time. So, the HSS comparison is only with the FPIE PRA results.

3.3.5 Comparison of Seismic PRA results to other PRA results for High Safety Significant Evaluation Structures, Systems, and Components Table 3-7 contains the SPRA fragility groups that are HSS along with the SSCs that make up those fragility groups. The table also shows whether the corresponding FPIE basic events are HSS. The mapping of the seismic fragility groups to the corresponding basic events in the FPIE generally fell into two groups. Many of the seismic fragility groups model SSCs that are explicitly modeled in the FPIE PRA. Other fragility groups model passive SSCs or SSCs that are not directly modeled in the FPIE but the SSC functions are explicitly modeled. The following sections provide more details of how the fragility groups are mapped to the basic events in the FPIE PRA.

3.3 Most of the SSCs modeled by the fragility groups are explicitly modeled in the FPIE PRA.

Fragility groups that model mechanical SSCs such as pumps, fans, EDGs, MOVs, and AOVs typically are modeled in the FPIE PRA. For example, the SEIS-SI-P-1AB fragility group models seismic failure of the Low Head Safety Injections pumps 1-SI-P-1A and 1B. The FPIE PRA has basic events that model failure to start, failure to run, and out of service for test and maintenance, which are modeled by basic events 1SI-PSB--FS-1A, 1SI-PSB--FR-1A, and 1SI-PSB--TM-1A, respectively for the A pump. The FPIE PRA also includes common cause failure of these pumps using basic events 1SI-PSB22FS-1A+B and 1SI-PSB22FR-1A+B for failure to start and run, respectively. Therefore, the mapping of the SSCs modeled in the seismic fragility groups for these types of SSCs is relatively straightforward.

3.3 Some of the seismic fragility groups model seismic failure of SSCs that are not explicitly modeled in the FPIE PRA. Table 3-6 contains details of how these fragility groups are mapped to corresponding basic events in the FPIE.

.5.1 Explicitly Modeled SSCs

.5.2 Implicitly Modeled SSCs

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-20 Table 3-6 Plant B Passive or Implicitly Modeled SSCs Scope Description not typically modeled in the FPIE PRA given their relatively low probability of random failure. The SPRA models building failures as failing the SSCs within the building. Therefore, in the comparison with the FPIE PRA, the seismic fragility groups that model building failures were mapped to basic events in the FPIE PRA that model failure of the SSCs within the building (typically the CCF of the SSCs).

-AFWPH This fragility group is mapped to the CCF basic event 1FW-

-ALL-AFW, which models common cause failure of the AFW pumps inside the pumphouse.

Electrical Panels such as Main Control Room (MCR) Panels, FLEX distribution panels, Vital Failures of MCR panels are typically not modeled in the FPIE PRA because of their relatively low probability of random failure. The SPRA models failure of the panels as failing Operator actions that rely on the panels for indications and control of mitigating functions. Therefore, the seismic failure of the MCR panels fragility group was mapped to an HEP in the FPIE PRA.

For the FLEX distribution panels where the FLEX 120VAC generators are connected to power the vital buses, the seismic fragility group for the FLEX panels is mapped to the vital bus basic events in the FPIE PRA.

Containment penetrations such as electrical and mechanical penetrations, fuel transfer tube, and containment hatches typically not modeled in the FPIE given their relatively low probability of random failure. The SPRA models failure of the reactor containment building, which includes electrical and mechanical penetrations, the hatches, and fuel transfer tube. Failure of these result in direct LERF and therefore are mapped to the LERF-83 plant damage state in the FPIE, which models direct LERF caused by containment bypass.

Relays The FPIE PRA does model some relays for impacts on the functions of actuation systems (for e

, Safety Injection, Containment Depressurization, etc.). The SPRA models relay chatter which impacts specific SSC functions due to spurious actuations (

starting/stopping of pumps, opening/closing of valves). Therefore, the seismic fragility groups that model relay chatter are mapped to the basic events of the corresponding SSC functions that are impacted in the FPIE PRA. The relays could also have been categorized in this sensitivity based on whether the cabinet the relays are located in are HSS.

Piping Piping failure is modeled in the FPIE PRA as part of the internal flooding portion of the model as well as failure of the RCS piping resulting in the various size LOCAs. The SPRA models piping failures of the RCS with seismic fragility groups for the various size LOCAs.

Therefore, these groups are mapped to the corresponding LOCA basic events in the FPIE PRA.

Building failures are Buildings For example, seismic fragility group SEIS BLDG models failure of the Auxiliary Feedwater Pumphouse.

PSB33FR Bus panels Containment penetrations except for containment isolation valves, are xample for example

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-21 3.3 Nearly all of the seismic fragility groups in the SPRA model correlated failures of the SSCs in the group. That is, given the common design, location, installation, and orientation of the SSCs, it is expected that both trains SSCs will fail given the same ground motion during a seismic event. This is similar to the modeling of common cause failures (CCF) in the FPIE PRA, where for multiple SSCs that have the same design and are maintained using the same maintenance processes, there is a probability that both components (for example, pumps) in the trains could fail due to common cause. However, some SSCs have such low failure probabilities in the FPIE PRA that common cause failures are not typically modeled. Tanks, heat exchangers, and electrical SSCs such as switchgear and motor control centers, are some examples of SSCs that may not have common cause failures modeled. In this sensitivity, the fragility groups that model correlated failures but do not have CCF basic events modeled in the FPIE were flagged in Table 3-7 with a check mark in the Correlation Review column. The six fragility groups identified here are all electrical SSCs such as switchgear, breakers, and electrical panels.

3.3.6 Analysis and Conclusions As shown in Table 3-7, all SSCs modeled by the seismic fragility groups that are HSS in the SPRA are also HSS in the FPIE PRA. The 38 HSS seismic fragility groups in the SPRA, which model over 200 SSCs, are also HSS in the FPIE PRA. And the two non-seismic failure basic events that are HSS in the SPRA are also HSS in the FPIE PRA.

This sensitivity shows that all of the SSCs that are HSS in the SPRA are also HSS in the FPIE PRA.

.5.3 Correlation of SSCs and Common Cause Failures

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-7 Sensitivity Study Results for Plant B Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC 1-BLD-BLD-RC-BLDG, 1-Containment is not modeled in the SEIS-Reactor 1-BLD-BLD-CE-EH-1, 1-FPIE PRA; but failure of the BLDG-RC Containment RC-BLDG CE-PH-1, 1-Structural N/A containment building would result FH-TB-1, 1-in failure of RCS piping, etc., which PE-EP*, 1-are considered HSS; PEN-PN*

SEIS-CV-Containment 1-CV-TV-TV-Vacuum 1-CV-TV-150AfB/C/D Functional N/A 150ABCD CIVs 150AfB/C/D 1-CV-SOV-150AfB/C/D Containment 1-RS Integrity Inside 1RSIA01-SEIS-RS-Recirc Spray 1-RS RELAY Relay chatter - Not explicitly P-1AB-1RSIA01-Functional N/A modeled in the FPIE PRA; Chatter RLY Pump RELAY 1-RS fails the function of the RS pumps.

Relays 1RSIB01-RELAY 1-RS-3A-SEIS-RS-Outside 1-RS-3A-1RSOA01-Relay chatter - Not explicitly P-2AB-Recirc Spray 1RSOA01-RELAY Functional N/A modeled in the FPIE PRA; Chatter RLYSS Pump RELAY 1-RS-3A-fails the function of the RS pumps.

Relays 1RSOB01-RELAY 3-22

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC Auxiliary Failure of the Aux Bldg is not SEIS-modeled in the FPIE PRA; Failure BLDG-AB-Building Building 1-BLD-BLD-Shear Wall N/A of the lower floors of the Auxiliary Lower CT-BLDG Failure LOWER Floors building is assumed to result in direct core damage.

Component Failure of the CCW HXs results in SEIS-CC-Cooling 1-CC-E-1A 1-CC-E-1A Anchorage N/A failure of the SW piping to the HXs, E-1AB Heat 1-CC-E-1B which causes a flood in the Exchangers Auxiliary building.

Core Charging/

Cooling and SEIS-CH-1-CH Various relays Relay chatter - Not explicitly Inventory P-1ABC-High Head 1CHCC09-in CH pump Functional N/A modeled in the FPIE PRA; Chatter SI Pump Control RLY Relays RELAY circuits fails the function of the CH pumps.

1-SW-MOV-101A/B/C/D SEIS-SW Supply 1-SW-MOV-MOV-Header to 1-SW-MOV-103A/B/C/D Recirc Spray Functional N/A QSPH-HX lsol 101A/B/C/D 1-SW-MOV-RSHX Valves 104A/B/C/D 1-SW-MOV-105A/B/C/D 3-23

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC Refueling SEIS-QS-Water 1-QS-TK-1 1-QS-TK-1 Tank N/A TK-1 Storage Overturning Core Tank Cooling and 1-Sl Inventory Low Head SI 1-Sl 1SILA01-Relay chatter - Not explicitly Control SEIS-SI-P-Pump RELAY 1SILA01-Functional N/A modeled in the FPIE PRA; Chatter 1AB-RLY Lockout RELAY 1-Sl fails the function of the SI pumps.

Relays 1SILB01-RELAY 1-RC-FA*

SEIS-RC-Control 1-RC-LRI*

Failure of Criticality CNTRL-Rods/Rx 1-RCS-1-RC-URI*

Fuel Hold N/A CRDM-xxx Down RODS Internals 1-RCS-Spring CRDM-xxx Not a fragility group; This This SSC is included because it is Secondary 1FP-DDP--

is the Fire pump out a non-seismic failure that has a F-Cooling TM-2 Diesel-of service for 1-FP-P-2 N/A N/A V greater than 0.005 in the SPRA.

Driven Fire maintenance This basic event is also HSS in the Pump being FPIE PRA.

OOS for Maintenance 3-24

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC SEIS-Auxiliary 1-BLD-BLD-AFW pumphouse and AFW pipe BLDG-Feedwater 1-BLD-BLD-AF PH-BLDG tunnel are not modeled in the FPIE (AFW)

AF PH-BLDG Structural N/A PRA; but failure of the pumphouse AFW 1-BLD-BLD-Pumphouse AFWT-BLDG or pipe tunnel would fail the AFW pumps.

MSVH failure is not in the FPIE SEIS-Main Steam 1-BLD-BLD-model; but failure of the MSVH BLDG-1-BLD-BLD-would fail the SG PORVs, TDAFW Valve House MSVH-BLDG MSVH-BLDG Structural N/A MSVH pumps steam supply, and direct LERF; These failures would be HSS in the FPIE PRA.

Emergency Secondary SEIS-CN-Condensate 1-CN-TK-1 Cooling TK-1 Storage 1-CN-TK-1 Anchorage N/A Tank 1-FW-GOV-2 Turbine-SEIS-FW-1-FW-P-2 P-2 DrivenAFW 1-FW-P-2 Functional N/A Pump 1-FW-TK-2 1-MS-TV-115 Motor-1-FW SEIS-FW-DrivenAFW 1-FW 1FWEA01-Relay chatter - Not explicitly RELAY P-3AB-Pump 1FWEA01-Functional N/A modeled in the FPIE PRA; Chatter RLY Lockout RELAY 1-FW fails the function of the AFW Relays 1FWEA01-pumps.

RELAY 3-25

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC SEIS-Medium (2"-

1-BLD-PIPE-1-BLD-PIPE-Failure of medium size RCS piping MLOCA 6") RCS RCS-MLOCA RCS-MLOCA Generic N/A is modeled in the FPIE PRA and is RCS Piping HSS.

Integrity SEIS-Small (1 "-2")

1-BLD-PIPE-1-BLD-PIPE-Failure of small size RCS piping is Generic N/A modeled in the FPIE PRA and is SLOCA RCS Piping RCS-SLOCA RCS-SLOCA HSS.

1-BLD-PIPE-RCS-RCS SEIS-Small-Small 1-BLD-PIPE-SSLOCA Failure of very small size RCS Integrity SSLOCA

(>1") RCS RCS-Various CH, Generic N/A piping is modeled in the FPIE PRA Piping SSLOCA SI and SS and is HSS.

AOVson small lines Not a FLEX This SSC is included because it is 0BDBEDG-fragility 120VAC 0-BDB-GEN-a non-seismic failure that has a F-

-FR-1A-group; FLEX Generator 1A N/A N/A V greater than 0.005 in the SPRA.

FLEX 120VAC Fails to Run This basic event is also HSS in the Generator FPIE PRA.

1-BDB-DB PANEL FLEX panels not modeled in the AC Power SEIS-BDB-FLEX 1-BDB-DB 1-BDB-DB Seismic FPIE PRA; Mapped to vital bus DB-123 Distribution PANEL PANEL Interaction N/A basic event since the FLEX panels Panels power the vital buses during a 1-BDB-DB SBO.

PANEL SEIS-EDG-EDG Relays 1-EG-3AX-Various relays Relay chatter - Not explicitly HJ-NR-

- Non-1EGSH10-in EDG Functional N/A modeled in the FPIE PRA; Chatter RLY Recoverable RELAY circuits fails the function of the EDGs.

3-26

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC SEIS-EDG-1-EG Various relays Relay chatter - Not explicitly HJ-RLY EDG Relays 1 EGSJ05-K2-in EDG Functional N/A modeled in the FPIE PRA; Chatter RELAY circuits fails the function of the EDGs.

SEIS-EE-EDG Output 1-EG Various relays Relay chatter - Not explicitly BKR-HJ2-Breaker 1EGPH01-in EDG output Functional N/A modeled in the FPIE PRA; Chatter RLY Lockout RELAY breaker fails the function of the EDG output Relays circuits breakers.

480V Bus Various relays Relay chatter - Not explicitly SEIS-EE-Supply 1-EE in 480V bus BKR-HJ8-Breaker 1EJSH01-supply Functional N/A modeled in the FPIE PRA; Chatter RLY Lockout RELAY breaker fails the power to the 480V Relays circuits emergency buses.

1-EG-B-01A Combined EDG batteries are not explicitly SEIS-EG-EDG 1-EG-B-03C Structural /

N/A modeled in FPIE, but would fail the AC Power B-1234 Batteries 1-EG-B-03C Function EDG, which is HSS in the FPIE PRA.

EDG day tank SEIS-EG-EDG Fuel level P-HAB-Oil Transfer 1-EG-LS-1JA switches, fuel Functional N/A JAB Pumps oil transfer pumps 120VAC SEIS-EP-Vital Bus 1-EP-CB-04A 1-EP-CB-04A Anchorage N/A CB-4ABCD Distribution

-04D Panels 480V 1-EE-SS-SEIS-EP-1H/1J SS-1H-1J Emergency 1-EE-SS-1 H 1-EE-ST-Functional N/A Buses 1H/1J 3-27

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC 1-EE-SW-SEIS-EP-4160V 1H/1J Combined SW-1H-1J Emergency 1-EE-SW-1J Associated Structural /

N/A Buses breakers in Function switchgear Seismic-SEIS-Induced AC Power LOOP Loss of LOOP LOOP Generic N/A Offsite Power 1-VB-INV 04 120VAC SEIS-VB-1-EE-TRAN-Regulating INV-1234 Vital Bus 79A transformers Functional N/A Inverters Hand switches SEIS-BY-Station 1-BY-8-1-11 Structural DC Power 8-1-24 Batteries 1-1-BY-8-1-IV failure of N/A 11/1-IV 1-BY-8-1-IV rack SEIS-EP-DC 1-EP-CB-12A DC Power CB-Distribution 1-EP-CB-12A Functional N/A 12ABCD Panels

-12D 1-EI-CB Control SEIS-EI-Main Control 07 Loss of function of MCR panels are Room CB-MCR-Room 1-EI-CB-03 1-EI-CB-21 Functional N/A not modeled in FPIE PRA, but Panels PNL Panels 1-EP-CB-B0C failure would impact HEPs, many of which are HSS in the FPIE PRA.

&D 3-28

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3 7 (continued)

Sensitivity Study Results for Plant B Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC SWVH is not modeled in the FPIE SEIS-Service 1-BLD-BLD-1-BLD-BLD-PRA; but failure of the Valve house BLDG-Water Valve SWVH-BLDG SWVH-BLDG Structural N/A would result in failure of SW SWVH House system, which is HSS in the FPIE PRA.

Service 1-SW Water SEIS-SW-Service 1-SW 1SWEA01-Relay chatter - Not explicitly P-1AB-Water Pump 1SWEA01-RELAY Functional N/A modeled in the FPIE PRA; Chatter RLY Lockout RELAY 1-SW fails the function of the Sw pumps.

Relays 1SWEB01-RELAY 38 19 0

Totals 38 38 Seismic Fragility 0

Groups classified as HSS via overlapping 50.69 criteria 3-29

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-30 3.4 Plant C Trial Categorization Evaluation This section documents the sensitivity performed using the Plant C SPRA.

3.4.1 Introduction 3.4.1.1 Plant Overview Plant C is a two-Unit Westinghouse PWR (four loop) site with each unit operating at 1150 MWe.

They entered commercial operation in 1987 (Unit 1) and 1989 (Unit 2). Emergency core cooling is accomplished via two centrifugal charging pumps, two safety injection pumps, and two residual heat removal pumps. There are two Emergency Diesel Generators (EDGs) that power the two emergency buses if offsite power is lost. There are four 120 VAC vital buses (two per emergency bus) powered by either the batteries/inverters or directly from the emergency buses through transformers. Three Auxiliary Feedwater (AFW) pumps (two motor-driven and one turbine-driven) provide steam generator cooling if the main Feedwater pumps are unavailable.

The ultimate heat sink is four mechanical draft cooling towers, where four pumps provide nuclear service cooling water (NSCW) to safety and auxiliary non-safety components. These NSCW pumps also remove the decay heat from the reactor when the plant is offline.

3.4.1.2 PRA Models The FPIE PRA, Fire PRA, and SPRA models contain logic for quantifying CDF and LERF for each unit. For this sensitivity, the results are from the Unit 1 PRA models only.

The SPRA model was developed by modifying the Full Power Internal Events (FPIE) PRA model to incorporate specific aspects of seismic analysis that are different from the FPIE. The logic model appropriately includes seismic-caused initiating events and other failures including seismic-induced SSC failures, non-seismic-induced unreliability and unavailability failure modes (based on the FPIE model), and human errors. The SPRA has top gates which are quantified using the EPRI FRANX software [23]. The cutsets are then processed using ACUBE [21] to obtain the final seismic CDF and LERF as well as the importance data.

The FPIE PRA underwent a full scope peer review in 2009. The FPIE model has been revised to resolve all F&Os received during the peer review. These were reviewed as part of the development of the SPRA to verify no impact on the SPRA results. The Fire PRA underwent a full scope peer review in 2012. The fire model has been revised to resolve all F&Os received during the peer review.

The SPRA model used for this sensitivity was peer reviewed in November 2014. The SPRA model has been revised to address the F&Os.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-31 3.4.2 Seismic PRA High Safety Significant Evaluation This section contains a summary of the SPRA Model and identification of HSS SSCs from the SPRA.

3.4.2.1 Description of Seismic PRA Model The Plant C SPRA model was developed by starting with the internal events at power PRA and adapting the model in accordance with guidance in the SPID [11] and PRA Standard [24],

including adding seismic fragility-related basic events to the appropriate portions of the internal events PRA, eliminating some parts of the internal events model that do not apply or that were screened-out, and adjusting the internal events PRA model human reliability analysis to account for response during and following a seismic event. The model is developed using the EPRI CAFTA software suite [25]. This model does not credit non-permanently installed FLEX equipment, but does include low leakage reactor coolant pump (RCP) seals. Both random and seismic-induced failures of modeled SSCs are included.

In the SPRA model, fully correlated components were assigned to correlated component groups so that all components in the group are modeled with the same basic event, such that if one fails, all fail at the seismic magnitude for each hazard bin. The model assumes fully correlated response of same or very similar equipment in the same structure, elevation, and orientation.

Correlated component groups were developed for all redundant components in the model that met these correlation criteria. For correlated groups where there was a significant difference in fragilities, then the higher capacity was used to assign a higher correlated fragility to both components, but the lower capacity component was also assigned a unique seismic capacity that only failed that component. Thus, the lower capacity component could fail by itself, but was guaranteed to fail if the higher capacity component was failed.

The seismic hazard was modeled using 14 discrete hazard intervals (or bins) based on increasing peak ground acceleration. Each bin is treated as a seismic initiator and the SCDF (and SLERF) results are summed over all the bins to obtain the total SCDF (and SLERF). Bin-specific SSC fragilities are used in the accident sequences for each bin.

For the SPRA, the following approach was used to quantify the seismic plant response model and determine seismic CDF and LERF. The EPRI FRANX software [23] was used to discretize the seismic hazard into the 14 seismic initiators, and quantify to produce cutsets and estimate the mean SCDF. The EPRI ACUBE [21] code was then used to calculate the exact probability on the entire set of SCDF/SLERF cutsets. This does not require the typical min cut upper bound approximation which can be excessively conservative when using high-probability events.

Additional details can be found in the following sections, along with descriptions of sensitivity studies, uncertainty estimations and a more complete description on the insights from top contributors to SCDF/SLERF.

The Plant C SPRA approach to determining the importance measures is to calculate the F-V and RAW measures for a component for each seismic acceleration interval, and then develop overall seismic importance values (for F-V and RAW) using the following weighted process to combine the importance values over all seismic acceleration intervals. For a component/basic event, the F-V and RAW are calculated by ACUBE 2.0 for each of the 14 seismic acceleration intervals, resulting in 14 F-V and RAW importance values by interval. The interval F-V values are

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-32 weighted based on the seismic acceleration interval CDF divided by the total seismic CDF, and summed together for each seismically failed fragility group to obtain the total F-V from the seismic failure. The RAW values are weighted and summed similarly to the F-V importance values. A similar process and weighting is used for LERF importance measures.

3.4.2.2 Identification of HSS SSCs from the SPRA Components are considered High Safety Significant (HSS) if the group F-V is greater than 0.005 or if the group RAW is greater than 2.0 for CDF or LERF. Therefore, if a group has a SCDF (SLERF) F-V or RAW that meet these HSS thresholds, then the SSCs in the group are considered HSS.

The SPRA also models non-seismic failures (for example, failure to start, run) of SSCs that can impact mitigating functions.

The results from the SCDF and SLERF quantification and importance show that 36 fragility groups and two non-seismic failure basic events are considered HSS. Table 3-9 lists these fragility groups and basic events. The SSCs that are modeled by these fragility groups are also listed in the table.

3.4.3 Full Power Internal Events PRA High Safety Significant Evaluation In the FPIE model, failure of SSCs are modeled for the different failure modes, such as pumps, fans, compressors, etc. failing to start, failing to run, failure to load, and out of service for test or maintenance. Additional failure modes may be modeled depending on the component. Common cause failures of the components are also included in the FPIE to account for possible design, maintenance and latent defects that could be common between similar components within the trains.

These SSC failures are modeled as basic events in the FPIE model. There are over 6000 basic events in the Unit 1 FPIE PRA that model over 1500 SSCs. The FPIE PRA is quantified using the EPRI PRAQuant software [22] to obtain the CDF and LERF cutsets. The truncations selected for these meet the PRA Standard for acceptable truncation. For CDF, a truncation of 1.0E-13 was used, while a truncation of 1.0E-15 was used for LERF. The importances are obtained from the cutsets directly (that is ACUBE is not used). A component is considered HSS if the sum of the CDF (LERF) F-Vs of the failure modes for the component is greater than 5.0E-03, or if any failure mode CDF (LERF) RAW is greater than 2.0.

3.4.4 Fire PRA High Safety Significant Evaluation The Fire PRA uses the FPIE model accident sequences. Fire scenarios were postulated and the equipment and cable failures were propagated through the appropriate accident sequences during the quantification process. The FRANX software [23] and the FTREX [26] quantification engine were used to quantify each fire scenario. FRANX software quantifies a CCDP or a conditional large, early release probability (CLERP) using the Minimal Cutset Upper Bound calculation. The CCDP or CLERP is combined with the product of the fire scenario ignition frequency, NSP and severity factor (SF) to calculate a CDF or LERF.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-33 The FRANX function to create a one top model was used. The one top model was quantified using the EPRI PRAQUANT software and the FTREX quantification engine to obtain a single cutset file which is used for fire risk results, importance measures, and uncertainty evaluation.

The FRANX software interacts with EPRIs CAFTA software suite, which is utilized by the FPIE PRA model. FTREX is the quantification software used for Units 1 and 2 Fire PRA, consistent with the FPIE model. The truncation values for CDF and LERF were 1E-12 and 1E-12 respectively. Similar to internal events the component importances were evaluated using the methodology described in Section 3.2.3. The determination of HSS or LSS from the Fire PRA can be found in Table 3-1 of this report.

3.4.5 Comparison of Seismic PRA Results to Other PRA Results for High Safety Significant Structures, Systems, and Components Table 3-9 contains the SPRA fragility groups that are HSS along with the SSCs that make up those fragility groups. The table also shows whether the corresponding FPIE and Fire basic events are HSS. The mapping of the seismic fragility groups to the corresponding basic events in the FPIE and Fire generally fell into two groups. Many of the seismic fragility groups model SSCs that are explicitly modeled in the FPIE and Fire PRA. Whereas, other fragility groups model passive SSCs or SSCs that are not directly modeled in the FPIE but the SSC functions are explicitly modeled. The following sections provide more details of how the fragility groups are mapped to the basic events in the FPIE PRA.

Most of the SSCs modeled by the fragility groups are explicitly modeled in the FPIE PRA and Fire PRA. Fragility groups that model mechanical SSCs such as pumps, fans, EDGs, MOVs, and AOVs typically are modeled in the FPIE PRA. So the mapping of the SSCs modeled in the seismic fragility groups for these types of SSCs is relatively straightforward.

s Some of the seismic fragility groups model seismic failure of SSCs that are not explicitly modeled in the FPIE PRA. Table 3-8 contains details of how these fragility groups are mapped to corresponding basic events in the FPIE.

3.4.5.1 Explicitly Modeled SSCs 3.4.5.2 Implicitly Modeled SSC

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-34 Table 3-8 Plant C Passive or Implicitly Modeled SSCs Scope Description ot typically modeled in the FPIE PRA given their relatively low probability of random failure. The SPRA models building failures as failing SSCs within the building or as leading directly to core melt or large early release. Therefore, in the comparison with the FPIE PRA or Fire PRA, the seismic fragility groups that model building failures were mapped to basic events in the FPIE and Fire PRA that model failure of the SSCs within the building.

categorization of Civil Structures.

Relays The SPRA models relay chatter which impacts specific SSC functions due to spurious actuations (fo starting/stopping of pumps, opening/closing of valves).

Therefore, the seismic fragility groups that model relay chatter are mapped to the basic events of the corresponding SSC functions that are impacted in the FPIE and Fire PRA.

Piping Piping failure is modeled in the FPIE as part of the internal flooding portion of the model as well as failure of the RCS piping resulting in the various size LOCAs. The SPRA models piping failures of the RCS with seismic fragility groups for the various size LOCAs. Therefore, these groups are mapped to the corresponding LOCA basic events in the FPIE PRA.

3.4.6 Analysis and Conclusions As shown in Table 3-9, most SSCs modeled by the seismic fragility groups that are HSS in the SPRA are also HSS in the FPIE and/or the Fire PRA. The 28 seismic fragility groups in the SPRA model over 63 SSCs, of which 23 are also HSS in the FPIE and/or Fire PRA. Eight have non-seismic failure mechanisms (marked as Random Failure in Table 3-9) that are HSS in the SPRA and are also HSS in the FPIE and/or the Fire PRA.

There are five seismic fragility groups that are HSS in the SPRA but not for the other considered risk categories (FPIE PRA, Fire PRA, Implicit Modeling, Passive Categorization). These five fragility groups represent correlated seismic failures or seismic induced internal flooding failures. These insights contributed to the creation of the approach described in Section 2.3.1 to account for the possibility of seismically correlated failures or seismic interaction related failures.

Building failures are n key Buildings See Section 3.6.6 for additional discussion of rexample

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive C t Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC S_1ACBS-120VAC 120 VAC Vital 1ACBSQ3Vl1 -

Functional 120PN-CB180 Panel CB 180 Panel 1ACBSQ3Vl4 (After)

S_1ACIV-AC Inverter Vital AC 1ACIVY3IA1 -

Functional 120-CB180 CB180 Inverter 11807Y3ID4 (After)

S_1ACSD-SFTY SF 1ACSDU3001 Functional SEQ Features Sequencer (After)

Sequencer Board 1ACSDU3002 S_1DCBC-Battery Battery 1AFPMP4002 Functional CB180 Charger Charger (After)

CB180 1AFPMP4003 Emergency S_1DCBS-125 voe 125 voe Functional Power MCC 1AD1M 1AFPMP4001 AC/DC MCC-AB and 1BD1M MCC (After)

S_1DCBS-All 125VDC 125 voe RL1AFW1512 Functional MCC-ALL MCC MCC 9

(After)

S_1DCBS-125 voe 1E 125 voe 1CCTKT4001 -

Functional PN-CB180-Distr. Panel -

Distr. Panel 1CCTKT4002 (After) 1E CB180 S_1DCBS-125 voe 125 voe 1DCBCB3CM Functional SGR-CB180 Switchgear Switchgear (After)

CB180 1DCBCB3CDB S_1DCBY-125 voe 125 voe 1DCBCS3DCA Functional CB180 Battery Battery (After)

CB180 1DCBCS3DCB 3-35

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive C t Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 (continued)

Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC Incoming Random N/A5 N/A5 1M02 FDR 1M0205 Failure BKR Incoming Random N/A5 N/A5 1BA03 FDR 1BA0301 Failure BKR Emergency 12s voe Random Power N/A5 N/A5 Battery 1DCBCS3DD1 Failure AC/DC 10D18 Reactor Trip Random N/A5 N/A5 Breaker 'A',

1RTA, 1RTB Failure Breaker 'B' Breaker to A N/A5 N/A5 Train NSCW 11ACDCS3AB Random Fan #1, #2, B

Failure

1. 3,#4 5 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-36

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive C t Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 (continued)

Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC S_1AFPM-BothAFW AFWMotor 1DCBSS3DCA Functional MOP MOP Driven Pump (After) 1DCBSS3DCC S_1AFPM-AFWTURB 1DCBSQ3DA1 Functional TOP AFWTDP Driven Pump (After) 1DCBSQ3DO1 Auxiliary Relay for Relay for 1DCBSS3DSA Feedwater S_1AFW-AFWPump AFWPump Functional AOV-RLY Turb Trip &

Turb Trip &

(During)

Throttle VL V Throttle VL V 1DCBSS3DSD

AFW, N/A5 N/A5 TDAFW 11302U4015 Random Pump, Disch, Failure Isolation Component CCWSurge CCWSurge 1DCBYB3BYA Correlated Failure drives the Cooling S_1CCTK-4 Tank Tank Anchorage SSC to HSS Water 1DCBYB3BYA S_1DG Diesel Diesel 1DGG4001 -

Functional Generator Generator 1DGG4002 (After)

DG Vent DGAIR 1DGDM12050 Emergency S_1DGDM-Damper for Supply Functional VENT Damper for (After)

Diesel Fans 1-4 1DGDM12054 Generator Fans DG BLDG DG BLDG 1DGFNB7002 S_1DGFN-ESF Supply ESF Supply 000-Functional Correlated Failure drives the FAN Fan Fan 1DGFNB7004 (After)

SSC to HSS 000 3-37

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive C t Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 (continued)

Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description System Fragility of Fragility Failure Comments Group Group Component Component Mode of Description ID SSC Contain-Anchorage Flooding causes LUHS drives ment Heat S_1FC-Failure of CTBAUX 1ACUA700200 Anchorage the SSC to HSS. Considered Removal ACU-FLD ACU with Cooling Unit 0

as a flooding interaction in the NSCWFLD Correlation Review.

Nuclear S_1SWFN-fan-NUC 1NSCWW4001 Service NSCWTower F01 -

Cooling NSCW-Fans SERVCool 1NSCW4002F Anchorage Water FANS Tower 04 Auxiliary Component S_1XCTK-4 ACCWSurge ACCWSurge 1XCTKT4001 Anchorage Correlated Failure drives the Cooling Tank Tank SSC to HSS Water Seismic Correlated anchorage Essential S_CB-Failure of CB 1 CHLRC70010 failure of two trains of ESF Chilled CHLR-ESF Chillers CB ESF 00-Anchorage Chillers leads to flooding NSCW-Cause NSCW Chiller 1 CHLRC70020 Water FLOOD Flood on CB 00 such that LUHS drives the 260 SSC to HSS Residual RCS to RHR Random Heat N/A6 N/A6 Pump B 1HV8702A Failure Removal Suction MOV 1RCPOPV0 Pressurizer Pressurizer 1PORV0455,1 Random Pressurizer 455A-U, 456-U PORVs PORVs PORV456 Failure 6 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-38

Correlation Review Seismic PRA FPIE PRA Fire PRA Implicit Modeling Passive C t Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-9 (continued)

Sensitivity Study Results for Plant C Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description Comments System Fragility of Fragility Component Failure Group Group Component Mode of Description ID SSC Containment, Auxiliary

Building, HSS due to RAW criteria in Control

Building, the SPRA.

Category 1 Emergency See Section 3.6.6 for Structures Civil Diesel Structural additional discussion of Structures Generator categorization of Civil Building, AFW Structures.

Pump House, Nuclear Safety Cooling Water Towers 17 17 1

0 23 Seismic Fragility 5

Totals 29 Groups classified as HSS via overlapping 50.69 criteria 3-39

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-40 3.5 Plant D Trial Categorization Evaluation This section documents the sensitivity performed using the Plant D SPRA.

3.5.1 Introduction Plant D is a two unit, Westinghouse PWR (four loop) site with sub-atmospheric (ice condenser) containments with each unit operating at approximately 1,150 MWe. Emergency core cooling is accomplished for each unit by two High Head Safety Injection pumps, two Intermediate Head Safety Injection pumps and two Low Head Safety Injection pumps. The high head pumps also provide normal Charging and RCP seal injection during non-accident conditions. There are four Emergency Diesel Generators (EDGs) that power the emergency buses if offsite power is lost.

There are four 120 VAC vital buses for each unit powered by either the batteries/inverters or directly from the emergency buses through transformers. Three Auxiliary Feedwater (AFW) pumps (two motor-driven and one turbine-driven) provide steam generator cooling if the main Feedwater pumps are unavailable. The ultimate heat sink is from the river, where eight pumps provide service water flow to both units via two headers.

The plants FPIE PRA and SPRA models contain logic for quantifying CDF and LERF for each unit. For this sensitivity, the results are from the Unit 1 PRA models only. The results for Unit 2 would be similar given that both units are nearly identical. This plant does not have a fire PRA but instead utilized the Appendix R Safe Shutdown (SSD) list of SSCs to classify components as HSS.

3.5.2 Seismic PRA High Safety Significant Evaluation Seismic failures of SSCs are modeled using fragility groups, which represent failure of groups of SSCs, typically both (multiple) trains if the SSCs are assumed to be correlated. Most of the SSCs are assumed to be correlated given similar design, location, and configuration.

The seismic hazard curve is divided into eight intervals and is modeled by eight seismic initiating basic events %G01 through %G08. Each fragility group is therefore modeled by eight seismic failure basic events representing the probability of failure for each of the eight seismic intervals of the seismic hazard curve.

The SPRA model is quantified using EPRI FRANX [23] to generate the cutsets, which are then processed with ACUBE [21] that uses the Binary Decision Diagram (BDD) to obtain a more accurate solution that reduces the overestimation that occurs when basic event probabilities are high.

ACUBE generates Fussell-Vesely (F-V) and Risk Achievement Worth (RAW) importance data for each basic event in the cutsets. Both F-V and RAW are used to obtain the importance of the fragility groups.

Fragility groups are considered High Safety Significant (HSS) if the group F-V is greater than 0.005 or if the group RAW is greater than 2.0 for CDF or LERF. Thus, if a group has a SCDF (SLERF) F-V or RAW that meet these HSS thresholds, then the SSCs in the group are considered HSS. Table 3-11 lists these fragility groups and basic events. The SSCs that are modeled by these fragility groups are also listed in the table.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-41 3.5.3 Full Power Internal Events PRA High Safety Significant Evaluation In the FPIE model, failure of SSCs are modeled for the different failure modes, such as pumps, fans, compressors, etc. failing to start, failing to run, failure to load, and out of service for test or maintenance. Additional failure modes may be modeled depending on the component. Common cause failures of the components are also included in the FPIE to account for possible design, maintenance and latent defects that could be common between similar components within the trains.

The FPIE PRA is quantified using the EPRI PRAQuant [22] software to obtain the CDF and LERF cutsets. The importances are obtained from the cutsets directly (that is ACUBE is not used). A component is considered HSS if the CDF (LERF) F-V of the failure mode for the component is greater than 5.0E-03, or if the CDF (LERF) RAW is greater than 2.0. A common cause failure basic event is considered HSS if the CDF (LERF) RAW is greater than 20.

3.5.4 Fire PRA High Safety Significant Evaluation Plant D does not have a Fire PRA at this time. So, the HSS comparison is only with the FPIE PRA results.

3.5.5 Comparison of SPRA results to the FPIE PRA results for HSS SSCs The mapping of the seismic fragility groups to the corresponding basic events in the FPIE generally fell into two groups. Many of the seismic fragility groups model SSCs that are explicitly modeled in the FPIE PRA. Whereas, other fragility groups model passive SSCs or SSCs that are not directly modeled in the FPIE but the SSC functions are explicitly modeled. The following sections provide more details of how the fragility groups are mapped to the basic events in the FPIE PRA.

.1 Most of the SSCs modeled by the fragility groups are explicitly modeled in the FPIE PRA.

Fragility groups that model mechanical SSCs such as pumps, fans, EDGs, MOVs, and AOVs typically are modeled in the FPIE PRA. Therefore, the mapping of the SSCs modeled in the seismic fragility groups for these types of SSCs is relatively straightforward.

.2 Implicitly Modeled SSCs Some of the seismic fragility groups model seismic failure of SSCs that are not explicitly modeled in the FPIE PRA. Table 3-10 contains details of how these fragility groups are mapped to corresponding basic events in the FPIE.

3.5.5 Explicitly Modeled SSCs 3.5.5

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-42 Table 3-10 Plant D Passive or Implicitly Modeled SSCs Scope Description Electrical Panels such as Main Control Room (MCR) Panels Failures of MCR panels are typically not modeled in the FPIE PRA because of their relatively low probability of random failure. The SPRA models failure of the panels as failing Operator actions that rely on the panels for indications and control of mitigating functions. Therefore, the seismic failure of the MCR panels fragility group was mapped to an HEP in the FPIE PRA.

Containment penetrations such as electrical and mechanical penetrations, fuel transfer tube, and containment hatches valves, are typically not modeled in the FPIE given their relatively low probability of random failure. The SPRA model includes failure of the containment penetrations by modeling a fragility group for containment penetrations, which includes electrical and mechanical penetrations, hatches, and the fuel transfer tube. Failure of these SSCs are modeled to result in direct LERF due to containment bypass.

Relays The FPIE PRA does model some relays for impacts on the functions of actuation systems (

, Safety Injection, Containment Depressurization). The SPRA models relay chatter which impacts specific SSC functions due to spurious actuations (

, starting/stopping of pumps, opening/closing of valves). Therefore, the seismic fragility groups that model relay chatter are mapped to the basic events of the corresponding SSC functions that are impacted in the FPIE PRA.

Piping Piping failure is modeled in the FPIE as part of the internal flooding portion of the model as well as failure of the RCS piping resulting in the various size LOCAs. The SPRA models piping failures of the RCS with seismic fragility groups for the various size LOCAs. Therefore, these groups are mapped to the corresponding LOCA basic events in the FPIE PRA.

.3 Seismic Fragi Nearly all of the seismic fragility groups in the SPRA model correlated failures of the SSCs they represent. That is, given the common design, location, installation, orientation, and function of the SSCs, it is expected that both trains SSCs will fail given the same ground motion during a seismic event. Therefore, the seismic fragility groups model common cause failure (CCF) of the SSCs during seismic events. In the mapping of the seismic fragility groups to the corresponding basic events in the FPIE PRA, the basic events that model failure of the individual SSC (that is not the CCF basic event) were selected if their F-V or RAW importances indicated they were HSS by themselves. However, if they were not HSS by themselves, then the fragility group was mapped to the CCF basic event.

Containment penetrations except for containment isolation for example for example 3.5.5 lity Groups and Common Cause Failure

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-43 3.5.6 Analysis and Conclusions As shown in Table 3-11, half of the SSCs modeled by the seismic fragility groups that are HSS in the SPRA are also HSS in the FPIE and/or the Fire PRA. The results for Plant D include 21 individual breakers in low and medium voltage switchgear spread over two Seismic Fragility Groups (SEIS_0-24 and SEIS_0-25), which make up the majority of items not explicitly identified as HSS in the FPIE and/or the Fire PRA. There are also two exhaust fans that have seismically correlated failures and four traveling screens that have seismically correlated failures.

These insights contributed to the creation of the approach described in Section 2.3.1 to account for the possibility of seismically correlated failures or seismic interaction related failures.

Finally, the Plant D results identify four seismic fragility groups associated with FLEX that are HSS in the SPRA but not HSS in the FPIE or Fire PRAs. Section 3.6.4 describes FLEX considerations within the 50.69 categorization process.

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of System Fragility Group Fragility Group Component Component Failure Comments Description ID Mode of SSC Norm FDR SEIS_0-24 Breaker Chatter, Low CNTL&AUX 1-BKR-212-Voltage Switchgear Vent BD 1A1-A001/10B-A Chatter A

480V SEIS_0-24 Breaker Chatter, Low Shutdown BD 1-BKR-212-Voltage Switchgear 1A1A Nor A001/1B-A Chatter Feed Norm FDR SEIS_0-24 Breaker Chatter, Low FORRXMOV 1-BKR-212-Voltage Switchgear BD 1A1-A (1-A001/88-A Chatter MCC-213-A1)

AC SEIS_0-24 Breaker Chatter, Low Norm Supply 1-BKR-212-Power Voltage Switchgear from 6.9KV A002/1B-A Chatter SD BD 1A-A Norm FDR for SEIS_0-24 Breaker Chatter, Low RXMOVBD 1-BKR-212-Voltage Switchgear 1A1-A (1-A002/8B-A Chatter MCC-213-A1)

Norm FDR for SEIS_0-24 Breaker Chatter, Low C&A Vent BD 1-BKR-212-Voltage Switchgear 181 (1-MCC-8001/108-B Chatter 215-81) 1-BKR-212-SEIS_0-24 Breaker Chatter, Low 8001/18-8, 1-BKR-212-Chatter Voltage Switchgear Norm Supply 8001/18-8 Chatter correlated from 6.9KV failure SD BD 18-8 3-44

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of System Fragility Group Fragility Group Component Component Failure Comments Description ID Mode of SSC Norm FDR for SEIS_0-24 Breaker Chatter, Low RXMOVBD 1-BKR-212-Chatter Voltage Switchgear 181-8(1-8001/88-8 Chatter correlated MCC-213-81) failure 1-BKR-212-SEIS 0-24 Breaker Chatter, Low 8002/18-8, 1-BKR-212-Chatter Voltage Switchgear Norm Supply 8002/18-8 Chatter correlated from 6.9KV failure SD BO 18-8 Norm FDR for SEIS 0-24 Breaker Chatter, Low RXMOVBD 1-BKR-212-Chatter Voltage Switchgear 182-8 (1-8002/88-8 Chatter correlated MCC-213-82) failure AC Breaker Chatter, Low Norm Supply Power SEIS_0-24 2-BKR-212-Voltage Switchgear from 6.9KV 8002/18-8 Chatter SD BO 28-8 Norm FDR SEIS 0-24 Breaker Chatter, Low CNTL&AUX 2-BKR-212-Chatter Voltage Switchgear Vent BO 2A1-A001/10B-A Chatter correlated A

failure 480V SEIS 0-24 Breaker Chatter, Low Shutdown BO 2-BKR-212-Chatter Voltage Switchgear 2-A1A NOR A001/18-A Chatter correlated FEED; failure Norm FDR for SEIS 0-24 Breaker Chatter, Low RXMOVBD 2-BKR-212-Chatter Voltage Switchgear 2A1-A (2-A001/88-A Chatter correlated MCC-213-A1) failure 3-45

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of System Fragility Group Fragility Group Component Component Failure Comments Description ID Mode of SSC SEIS 0-24 Breaker Chatter, Low Norm Supply 2-BKR-212-Chatter Voltage Switchgear from 6.9KV A002/1B-A Chatter correlated SD BO 2A-A failure Norm FDR for SEIS 0-24 Breaker Chatter, Low RXMOVBD 2-BKR-212-Chatter Voltage Switchgear 2A2-A (2-A002/8B-A Chatter correlated MCC-213-A2) failure Norm FDR for SEIS 0-24 Breaker Chatter, Low C&A Vent BO 2-BKR-212-Chatter Voltage Switchgear 281-8 (2-8001/108-B Chatter correlated MCC-214-81) failure AC SEIS 0-24 Breaker Chatter, Low Nor Supply 2-BKR-212-Chatter Voltage Switchgear from 6.9KV 8001/18-8 Chatter correlated Power SD BO 28-8 failure Norm FDR for SEIS 0-24 Breaker Chatter, Low RXMOVBD 2-BKR-212-Chatter Voltage Switchgear 281-8 (2-8001/88-8 Chatter correlated MCC-213-81) failure Norm FDR for SEIS 0-24 Breaker Chatter, Low RXMOVBD 2-BKR-212-Chatter Voltage Switchgear 282-8 (2-8002/88-8 Chatter correlated MCC-213-82) failure Norm FDR for SEIS_0-24 Breaker Chatter, Low VITBATT 0-BKR-236-Voltage Switchgear CHGR Ill (0-0003-A Chatter CHGR-236-3) 3-46

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments Fragility Component Failure System Fragility Group Component Mode of Group Description ID SSC Norm FDR for Breaker Chatter, Low VITAL 0-BKR-236-Chatter BATTCHGR IV SEIS_0-24 Voltage Switchgear (0-CHGR-236-0004A-B

4)

Breaker Chatter, Norm Supply 1-BKR-211-from 6.9KV Chatter SEIS_0-25 medium voltage COMMON 1716/16-A switchgear SWGC Breaker Chatter, Norm Supply 1-BKR-211-from 6.9KV Chatter SEIS_0-25 medium voltage COMMON 1728/16-8 switchgear SWGD AC 1-BKR-212-Chatter Power Breaker Chatter, 8001-B, 480V 1-BKR-212-correlated Chatter SEIS_0-25 medium voltage Shutdown 8001-B failure switchgear XFMR 181 (1-OXF-212-81) 1-BKR-212-Chatter Breaker Chatter, 8002-B, 480V 1-BKR-212-Chatter correlated SEIS_0-25 medium voltage Shutdown 8002-B failure switchgear XFMR 182 (1-OXF-212-82) 1-BKR-211-Chatter Breaker Chatter, 6.9kV SDBD 1816/16-A, Chatter correlated SEIS_0-25 medium voltage Breaker 1816, 1-BKR-211-failure switchgear 1828 1828/16-8 3-47

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments System Fragility Failure Fragility Group Component Component Mode of Group Description ID SSC ALT Supply 1-BKR-211-Chatter Breaker Chatter, from 6.9KV 1934/1-8, Chatter correlated SEIS_0-25 medium voltage Common SWG 1-BKR-211-failure switchgear C,D 1932/1-A 1-BKR-212-A001-A, 480V 1-BKR-212-Chatter Breaker Chatter, Shutdown A001-A, correlated Chatter SEIS_0-25 medium voltage XFMR 1A1 (1-1-BKR-212-failure switchgear OXF-212-A1),

A002-A 182 (1-OXF-212-A2)

ALT Supply 2-BKR-211-Chatter Breaker Chatter, from 6.9KV 1938/1-8, 2-Chatter correlated AC SEIS_0-25 medium voltage Common SWG BKR-211-failure Power switchgear C,D 1936/1-A 6.9kV Supply to Chatter Breaker Chatter, Transformer 2-BKR-212-Chatter correlated SEIS_0-25 medium voltage 2A1A (2-BKR-A001/A failure switchgear 212-A1-A) 480VSHDN Trans 2A2-A 2-BKR-212-(2-OXF-212-A2-A002-A, Chatter Breaker Chatter, A), 281-8 2-BKR-212-Chatter correlated SEIS_0-25 medium voltage (2-OXF-212-8001-B, failure switchgear 81-8), 282-8 2-BKR-212-(2-OXF-212-8002-B 82-8) 3-48

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Comments Description of Failure System Fragility Fragility Group Component Component Mode of Group Description ID SSC 1-INV-235-0001-D, 1-INV-235-120V AC Vital 0002-E, Anchorage SEIS_3-1 AUX 480V Inverter Inverter 1-1, 1-11, 1-INV-235-1-111, 1-IV 0003-F, 1-INV-235-0004-G 2-INV-235-AC 0001-D, 2-INV-235-Power 120V AC Vital 0002-E, Anchorage SEIS_3-1 AUX 480V Inverter Inverter 2-1, 2-11, 2-INV-235-2-111, 2-IV 0003-F, 2-INV-235-0004-G 6.9KV Normal 1-BKR-211-Supply Breaker 1716/16-A, Random N/A7 N/A7 for Shutdown 1-BKR-211-Board 1728/16-8 7 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-49

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments Failure System Fragility Fragility Group Component Component Mode of Group Description ID SSC 0-BAT-236-0001-D, 125VDC Vital 0-BAT-236-0002-E, Functional DC SEIS_2-1 125VDC Vital Battery Battery I, 11, 0-BAT-236-Power 111, IV 0003-F, 0-BAT-236-0004-G 0-CHGR-236-0001-D, 125VVital 0-CHGR-236-125V Vital Battery Battery 0002-E, Functional DC SEIS_3-3 Charger I, 11, 0-CHGR-236-Power Charger Ill, IV 0003-F, 0-CHGR-236-0004-G 3-50

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments Failure System Fragility Fragility Group Component Component Mode of Group Description ID SSC EDGswould be treated as HSS in the 50.69 defense-in-depth 1-GEN-082-review.

EOG random 0001A-A, Random See Section N/A8 N/A8 failure to start 1-GEN-082-3.6.5 for and/or run 00018-8 additional discussion of Emergency defense-in-depth.

Diesel Generator 1-FAN-030-0447-A, 1-FAN-030-0449-8, Diesel 1-FAN-030-Random N/A8 N/A8 Generator 0451-A, Exhaust Fan 1-FAN-030-0453-8, 1-FAN-030-0459-A Component CCS Surge Tank CCS Surge 1-TANK-070-Anchorage Cooling SEIS 19-10 A

Tank A 0001 Water 8 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-51

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments System Fragility Failure Fragility Group Component Component Mode of Group Description ID SSC Refueling Water Refueling 1-TANK-063-Anchorage SEIS 19-14 Water 0046 Onsite Storage Tank Storage Tank Water 1-TANK-063-Sources SIS Boron SIS Boron Anchorage SEIS 19-9 Injection Tank Injection Tank 0036 1-HTX-070-Component CCS Heat CCS Heat

0185, Exchanger A, Anchorage Cooling SEIS_20-1 Exchanger 1-HTX-070-Water B

0186 6900V STDN 1-PNL-211-A-A, 6.9 Logic Relay LOG REL Functional AC Relay SEIS_S-1 1-PNL-211-8-8 Panel Panel PNL 1A-A, 18-8 3-52

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments System Fragility Fragility Group Component Component Failure Group Mode of Description ID SSC Aux 1-PMP-003-Aux Feedwater Feedwater 0118-A, Anchorage SEIS_11-6 Pump Pump 1A-A, 1-PMP-003-18-8 0128-B Seismic fails TDAFW both AC and Pump Room 1-FAN-030-DC Fans AFW Exhaust Fan 125V DC Functional together SEIS_17-4 0214 EMERG EXH (correlated FAN seismic failure)

Seismic fails TDAFW both AC and Auxiliary Pump Room 1-FAN-030-DC Fans Feedwater SEIS_17-4 AFW Exhaust Fan 120V AC 0217 Functional together EMERG EXH (correlated FAN seismic failure)

AUXFW TURBINE TDAFWP Control FLOW 1-PNL-276-Anchorage SEIS_S-17 Panels (BECKMAN L381 DWG 797492)

Aux Feedwater Aux 1-PNL-276-Feedwater Functional SEIS_S-18 Controls Control L381A 3-53

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments Fragility Failure System Fragility Group Component Component Mode of Group Description ID SSC 1-TWS-067-0434-A, Internal Events Ranking ERCW 1-TWS-067-was based on individual Emergency ERCW Traveling Traveling 0445-8, Anchorage component, but Internal Raw SEIS_24-1 Screen 1 A-A, 2-TWS-067-Events RAW for Common Cooling Screen 18-8, 2A-A, cause of TWS is 23 0439-A, Water 28-8 2-TWS-067-0451-8 Main Control Room Generator&

1-PNL-278-Functional SEIS 5-10 Panel Aux Power M001 120VAC Main Control Room PREFERRED 1-PNL-278-Functional SEIS_5-10 Panel POWER M007 RACK UNIT 1 0-PNL-278-Main Control Room M026A-A, 0-PNL-278-Functional SEIS_5-12 DSL Gen 1A-M026A Panel A Main Cont MCR RM Panels 0-PNL-278-Main Control Room M0268-8, 0-PNL-278-Functional SEIS_5-12 DSL GEN 18-M0268 Panel 8MAIN CONT RM 0-PNL-278-Main Control Room M026C-A, 0-PNL-278-Functional SEIS_5-12 DSL GEN 2A-M026C Panel AMAIN CONT RM 3-54

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments System Fragility Fragility Group Component Component Failure Group Mode of Description ID SSC 0-PNL-278-Main Control Room M026D-8, 0-PNL-278-DSL GEN 28-Functional SEIS_S-12 Panel M026D 8MAIN MCR CONT RM Panels Main Control Room ERCWMAIN 0-PNL-278-Functional SEIS_S-12 Panel CNTL RN M027A PNL Main Control Room COMP COOL 0-PNL-278-Functional SEIS_S-12 Panel WATER PNL M0278 FLEX is modeled in Internal events for LOOP 6900V3MW 0-DG-360-but does not show up as SEIS_3MW 3MWFLEXDGs FLEX Diesel

0003A, Anchorage important. See Section FLEX FLEXDG Generator 3A, 0-DG-360-3.6.4 for additional 38 00038 discussion of FLEX components.

3-55

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Failure Comments System Fragility Fragility Group Component Component Mode of Group Description ID SSC FLEX is modeled in Internal events for LOOP but 480V does not show FLEX/ESBO 0-DG-360-up as SEIS_480 225 KVA

000A, Anchorage important. See VFLEXDG 480V FLEX Gs DIESEL 0-DG-360-GENERATO 0008 Section 3.6.4 R

for additional discussion of FLEX FLEX components.

FLEX is modeled in Internal events for LOOP but O-PNL-360-0-PNL-360-does not show up as SEIS_FLE 480VFLEX DG FP/A, 480V FP/A, Functional important. See XBUS Buses FLEX Fuse 0-PNL-360-Panel A, B FP/8 Section 3.6.4 for additional discussion of FLEX components.

3-56

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Description of Comments System Fragility Fragility Group Component Component Failure Group Mode of Description ID SSC FLEX is modeled in O-TANK-360-Internal events 0113, 360-0-TANK-360-for. See SEIS_FLE 0213,6900V

0113, Anchorage Section 3.6.4 FLEX XTANK FLEX Fuel Tanks 3MWFLEX 0-TANK-360-for additional DG Fuel oil 0213 discussion of Storage Tank FLEX components.

Turbine Driven 1-PMP-003-TDAFW N/A9 N/A9 Auxiliary 0001A-S Random Pump Feedwater Pump 9 This entry is not a Seismic Fragility Group. It is random failure of the SSC to function (i.e. start, run, or other PRA functional failure) 3-57

Correlation Review Seismic PRA FPIE PRA Fire Risk Implicit Modeling Passive Cat.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites Table 3-11 (continued)

Sensitivity Study Results for Plant D Component from Fragility Group that HSS in Risk Evaluations Governs the Fragility Seismic Comments Description of Failure System Fragility Fragility Group Component Component Mode of Group Description ID SSC Containment penetrations would be treated as HSS in the 50.69 defense-in-Seismically-induced depth review.

Contain-SEIS Failure of Containment Various Structural See Section ment CONPEN Containment penetrations 3.6.5 for Penetrations Penetrations additional discussion of defense-in-depth.

31 4

0 1

35 Seismic Fragility Groups classified as Totals 64 HSS via overlapping 24 50.69 criteria, including 2 items addressed by defense-in-depth criteria 3-58

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-59 3.6 Summary of Sensitivity Study Insights Sections 3.2 through 3.5 describe trial 50.69 categorization evaluations performed at four plants to determine how the seismic related categorization insights compare with categorization insights at the same plants using their FPIE PRAs and fire PRAs, if available. Overall conclusions are summarized in this section.

3.6.1 Limited Unique Seismic High Safety Significant Structures, Systems, and Components In all four trial studies, there were either no components or very few components identified as HSS in the SPRA that were not also HSS for another reason. Therefore, the seismic risk insights provided only limited unique insights into the 50.69 categorization process. And those unique insights were generally associated with SSCs that would be treated as seismically correlated failures in an SPRA. This suggests that the SSCs most important in responding to a seismic event are included within the set of SSCs necessary to respond to other events.

This result should not be interpreted to suggest that there are no SSCs that would be HSS from a seismic hazard. In each study, there were a significant number of HSS SSCs identified using the SPRAs. However, those same SSCs were also HSS for other reasons.

The trial studies indicate that the overall benefits, in terms of seismic risk insights in the 50.69 categorization process, do not warrant the cost of performing an SPRA.

3.6.2 Seismic Correlated Failures Some of the trial studies identified a limited number of seismic-related HSS SSCs due to the way seismically correlated failures are typically treated in SPRAs. For example, if two pumps performing the same function are located side by side in the plant, they are both assumed to fail with the same seismic fragility. These correlated failures can contribute unique seismic insights into the 50.69 categorization process.

In the case of passive items such as tanks, two similar tanks located side by side would generally also be assumed to fail with the same seismic fragility. This correlated failure is not identified by the 50.69 passive categorization process, which relies on the FPIE PRA, which does not model common cause failure of tanks.

The trial studies indicate that special considerations may be necessary for evaluating the potential of seismically correlated failures to influence the categorization process at sites where the correlated failures may be likely.

3.6.3 Relays Relays are important components in NPP seismic evaluations. Many FPIE PRAs do not explicitly include relays in their models and they are usually added to the model for an SPRA.

However, important relays such as those in the emergency power systems are critical to the success of the backup AC power function and therefore would be implicitly addressed by the FPIE PRA insights in the 50.69 categorization process. For example, all four trial evaluations identified parts of the emergency power system as HSS in the SPRA, the FPIE PRA and/or the Fire PRA. If the relays within those systems, or the electrical enclosures housing the relays, are

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-60 not explicitly modeled in the FPIE PRA, then their 50.69 categorization would be derived by identifying the importance of the system function and correlating those functions with the specific components. Section 5 of NEI 00-04 provides the following guidance.

Some systems and structures are implicitly modeled in the PRA. It is important that PRA personnel that are knowledgeable in the scope, level of detail, and assumptions of the plant-specific PRA make these determinations. As outlined in Section 1, by focusing on the significance of system functions and then correlating those functions to specific components that support the function, it is possible to address even implicitly modeled components.

Therefore, in the case of relays in the emergency power system, the relays would be implicitly modeled in the FPIE PRA and their function within the system would need to be evaluated to perform 50.69 categorization down to the component level.

3.6.4 FLEX Components As noted in Section 3.5, one of the sensitivity studies identified that some FLEX equipment exceeded the quantitative categorization thresholds within the SPRA but the FLEX equipment was not identified as HSS in the FPIE PRA model. With respect to 50.69 programs, inclusion of FLEX equipment in the PRA model can impact a 50.69 program in two ways; categorization results and application of alternate treatment.

With respect categorization results, inclusion of FLEX equipment in the PRA model (for example, FPIE PRA, seismic PRA) would act to, at worse, make some modeled non-FLEX equipment appear to be less safety significant as compared to the PRA results with the FLEX equipment not modeled. This is because the 50.69 categorization process uses relative risk metrics (that is RAW, F-V) and if the FLEX equipment is providing relative value (for example, reducing CDF), then the other modeled equipment (non-FLEX) would become less important.

That is, some previously categorized RISC-1 components could become RISC-3 components when the FLEX equipment is included in the PRA model. Thus, not including FLEX equipment in the PRA model for 50.69 categorization is at worst conservative from a RISC-3 assignment perspective.

From an alternative treatment perspective, for plants that chose to categorize FLEX equipment, these components will be categorized as either RISC-2 (non-safety related / safety significant) or RISC-4 (non-safety related / non-safety significant). The rule [1] requires that for RISC-2 components:

The licensee shall ensure that SSCs perform their functions consistent with the categorization process assumptions by evaluating treatment being applied to these SSCs to ensure that it supports the key assumptions in the categorization process that relate to their assumed performance.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-61 10 CFR 50.69 was published in 2004. As such, while the rule requirement to ensure that the treatment of RISC-2 SSCs is consistent with the assumed performance in the PRA is a valid position, it does not reflect the maturing of PRAs over the ensuing years such as the need to reflect Regulatory Guide 1.200, Rev 2 and later revisions of the ASME / ANS PRA Standard [24]. Additionally, each 50.69 license amendment request contains a section on PRA Technical Adequacy which assures that the plant-specific PRA is adequate to support the 50.69 categorization effort, including a complete treatment of causes of system failures, reliability and unavailability of modeled SSCs. Thus, by meeting RG1.200 [17] and ASME/ANS Standard [24]

guidance, it is assured that the performance assumed in the PRA for FLEX equipment is consistent with plant practices.

Further, in response to post-Fukushima actions, licensees are required to demonstrate that FLEX equipment is stored, tested, maintained and procedures are in place so that the FLEX equipment can fulfill their stated missions.

3.6.5 Defense-in-Depth Assessment NEI 00-04 [2] Sections 6.1 (Core Damage Defense-in-Depth) and 6.2 (Containment Defense-in-Depth) provide guidance for incorporating considerations to assure that defense in depth is preserved when categorizing an SSC as low safety significant.

With respect to core damage, the assessment considers both the level of defense-in-depth in preventing core damage and the frequency of the events being mitigated. This ensures that adequate defense-in-depth is available to mitigate design basis events given their likelihood of occurrence, including consideration of diverse and redundant trains and systems in the overall categorization process.

With respect to containment, the assessment considers SSCs that play a role in preventing large, early releases, such as interfacing systems LOCA (BWR and PWR), steam generator tube leak (PWR), containment isolation failures (BWR and PWR), and early hydrogen burns (ice condenser and Mark III containments). Containment defense-in-depth is also assessed for SSCs that play a role in preventing large containment failures (for example, due to loss of containment heat removal).

3.6.6 Civil Structures NEI 00-04 [2] requires that both F-V and RAW importance measures be considered in 50.69 categorization. The RAW importance measure is calculated assuming the SSC (or basic event) is always failed. Although this is a useful importance measure for bounding discussions and for FPIE PRAs, in SPRAs RAW implies that the SSC has no seismic capacity and the RAW insights should be considered with some care when used in an SPRA.

When applied literally for Category 1 civil structures such as Reactor Buildings or Auxiliary Buildings that house critical systems and components, high RAW values can be expected because it implies that the structure is failed. The RAW metric can also be sensitive to cutset truncation depending upon the base probability of the basic event in question and the cutsets in which the basic event participates.

Seismic PRA Insights and Trial Categorization Studies Conducted on High Seismic Hazard Sites 3-62 It is recognized that civil structures containing PRA credited equipment (for example, Reactor Building) are likely important to safety because their failure can fail the credited equipment functions. Therefore, if a licensee chooses to categorize structures under 50.69 using the guidance in this report, the recommended practice is to consider civil structures housing HSS SSCs to be HSS themselves, unless otherwise justified. Note that this does not imply that everything inside an HSS structure should then be considered HSS.

4-1 4

SUMMARY

AND CONCLUSIONS The NRCs 10 CFR 50.69 process [1] allows a plant to categorize the safety significance of its SSC using a robust categorization process defined in NEI 00-04 [2], as endorsed by NRC in Regulatory Guide 1.201 [3]. The risk-informed categorization process helps focus attention on SSCs that are the most important to plant safety while allowing increased operational flexibility for SSCs that are less important to plant safety.

One of the screening criteria evaluated in the categorization process specified in NEI 00-04 is seismic risks, which can be evaluated using an SPRA, or an SMA if an SPRA is not available, or screened out if the SCDF and SLERF are very small compared to the FPIE PRA CDF and LERF.

There are a number of plants that do not have an acceptable SPRA or SMA and cannot screen out of seismic considerations, therefore a need exists to consider alternatives for considering the insights of seismic risks in the 50.69 categorization process.

This report develops alternate approaches for plants to provide the necessary seismic risk insights within the 50.69 categorization process. Trial 50.69 categorization evaluations are performed at four plants with SPRAs and high GMRS compared to their SSEs to determine the seismic related categorization insights. Those insights are compared with categorization insights at the same plants using their FPIE PRAs and fire PRAs if available to determine the degree to which the seismic insights produce unique categorization insights.

The trial case results show that there were either no components or very few components identified as HSS in the SPRA that were not also HSS for another reason. Therefore, the seismic risk insights provided only limited unique insights into the 50.69 categorization process. And those unique insights were generally associated with SSCs that would be treated as seismically correlated failures in an SPRA.

These insights are used to develop a three-tiered graded approach for considering seismic risks in the 50.69 categorization process. The tiers are defined based on the degree to which the plant GMRS exceeds the plant SSE, which influences the likelihood that unique seismic-related HSS SSCs will be identified. The tiers and recommended seismic risk evaluation processes are described in Table 4-1.

For Tier 2 seismic hazard plants, a new seismic risk evaluation process is developed to use the FPIE PRA to determine the categorization insights appropriate for seismically correlated failures.

SSCs that would be treated as seismically correlated in an SPRA are identified through a series of reviews and seismic walkdowns, those SSCs are modeled with new common cause failure basic events in the FPIE PRA, and sensitivity studies are performed to determine if specific SSCs should be HSS.

Summary and Conclusions 4-2 Table 4-1 Alternate Approach Seismic Tiers and Seismic Rick Evaluation Process Tier Tier Criteria Seismic Risk Evaluation Processes 1

acceleration is at or below equal to the SSE between 1.0 Hz and 10 Hz. At these sites, the within the range of the SSE such that unique seismic categorization At Tier 1 sites g a unique seismic condition that would cause an SSC to be designated HSS is very low.

Therefore, with little to no anticipated unique process using the FPIE PRA evaluations along with the required Defense-in-Depth and Integrated Decision-(IDP) qualitative considerations adequately identify the safety-significant functions and SSCs required for those functions and no additional seismic reviews are categorization.

2 comparison between 1.0 Hz and 10 Hz is greater than in Tier 1 but not high enough to be treated as Tier 3.

At these sites, the unique seismic to be limited.

At Tier 2 sites, there may be a limited number to the possibility of seismically correlated failures, appropriate for consideration in determining HSS SSCs. The special seismic recommended using a Common Cause impact approach in the FPIE PRA can identify the appropriate seismic insights to be considered with the other categorization insights by the Integrated Decision-determinations.

3 SSE comparison between 1.0 Hz and 10 Hz is high enough that the NRC required the plant to perform an SPRA to

].

At Tier 3 sites, the available methods in NEI 00-04 2] can be used to provide seismic inputs to the categorization process. These methods include the use of an SPRA or an SMA as described in NEI 00-04 Section I the likelihood of identifyin Plants where the GMRS peak approximately 0.2g or where the seismic insights, the 50.69 categorization GMRS is below or approximately and other risk making Panel GMRS is either very low or are expected to insights are expected to be minimal.

necessary for 50.69 of unique seismic insights, most likely attributed Plants where the GMRS to SSE risk evaluation process categorization insights are expected making Panel (IDP) for the final HSS Plants where the GMRS to

[

respond to the Fukushima 5.3 50.54(f) letter [6

5-1 5

REFERENCES

1. Nuclear Regulatory Commission, 10 CFR Part 50 Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors; Final Rule, Federal Register / Vol. 69, No. 224 / Monday, November 22, 2004

2. NEI 00-04, Rev 0, 10 CFR 50.69 SSC Categorization Guideline, July 2005.

3. NRC Regulatory Guide 1.201, Rev 1, Guidelines for Categorizing Structures, Systems, and Components in Nuclear Power Plants According to their Safety Significance

4. Generic Letter 87-02, Verification of Seismic Adequacy of Mechanical and Electrical Equipment in Operating Reactors, Unresolved Safety Issue (USI) A-46, U.S. Nuclear Regulatory Commission, Washington, DC, February 19, 1987.

5. Generic Letter 88-20, Supplement 4, "Individual Plant Examination of External Events (IPEEE) For Severe Accident Vulnerabilities - 10 CFR 50.54(f), (Generic Letter No. 88-20, Supplement 4)," U.S. Nuclear Regulatory Commission, Washington, DC, June 28, 1991.

6. NRC (E Leeds and M Johnson) Letter to All Power Reactor Licensees et al., Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendations 2.1, 2.3 and 9.3 of the Near-Term Task Force Review of Insights from the Fukushima Dai-Ichi Accident, March 12, 2012.

7. IEEE Recommended Practice for Seismic Qualification of Class I E Equipment for Nuclear Power Generating Stations. Institute of Electrical and Electronics Engineers. IEEE Standard 344-2004.

8. Generic Implementation Procedure (GIP) for Seismic Verification of Nuclear Plant Equipment, Seismic Qualification Group, Washington, DC: February 1992.

9. IPEEE Seismic Insights: Revision to EPRI Report TR-112932, EPRI, Palo Alto, CA: 2000.

1000895.

10. Seismic Walkdown Guidance: for Resolution of Fukushima Near-Term Task Force Recommendation 2.3: Seismic. EPRI, Palo Alto, CA: 2012. 1025286.

11. Seismic Evaluation Guidance: Screening, Prioritization and Implementation Details (SPID) for the Resolution of Fukushima Near-Term Task Force Recommendation 2.1: Seismic.

EPRI, Palo Alto, CA: 2013. 1025287

12. NEI 12-06, Rev 4, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, December 2016

13. SECY-16-0142, Draft Final RuleMitigation of Beyond-Design-Basis Events (RIN 3150-AJ49)., December 2016

References 5-2

14. U.S. NRC, Issuance of Order to Modify Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, Order No.EA-12-049, ADAMS Number ML12054A735, Washington, D.C., March 12, 2012.

15. Fire-Induced Vulnerability Evaluation (FIVE), Rev 2. EPRI, Palo Alto, CA: 2014.

3002000830

16. Risk-Informed Engineering Programs (10 CFR 50.69) Implementation Guidance (DRAFT),

NEI 16-09, Rev 0 (2017)

17. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

18. Seismic Probabilistic Risk Assessment Implementation Guide. EPRI, Palo Alto, CA: 2013.

3002000709.

19. A Methodology for Assessment of Nuclear Plant Seismic Margin, Revision 1. EPRI, Palo Alto, CA: 1991. NP-6041-SL

20. Risk & Reliability Interface (R&R Interface) Version 2.0. EPRI, Palo Alto, CA: 2015.

3002005279

21. Advanced Cutset Upper Bound Estimator(TM) (ACUBE), Version 2.0. EPRI, Palo Alto, CA:

2014. 3002003169

22. PRAQUANT 5.2. EPRI, Palo Alto, CA: 2015. 3002002796

23. FRANX Version 4.4. EPRI, Palo Alto, CA: 2017. 3002010659

24. Addenda to ASME/ANS RA-S-2008, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ASME/ANS RA Sb 2013, ASME, New York (2013).

25. Computer Aided Fault Tree Analysis System, (CAFTA), Version 6.0b. EPRI, Palo Alto, CA:

2014. 3002004316

26. Fault Tree Reliability Evaluation eXpert (FTREX) Version 1.8. EPRI, Palo Alto, CA: 2015.

3002005280

27. NUREG/CR-2015, Vol.8, Seismic Safety Margins Research Program; Systems Analysis (Project VII), Lawrence Livermore National Laboratory, Livermore, California, 1981.

28. NUREG/CR-4840, Procedures for the External Event Core Damage Frequency Analyses for NUREG-1150, SAND88-3102, Sandia National Laboratories, Albuquerque, New Mexico, 1990.

29. NUREG/CR-7237, Correlation of Seismic Performance in Similar SSCs (Structures, Systems, and Components), Published December 2017.

30. Correlation of Earthquake Failures in Selected Categories of Equipment for Application to Seismic Probabilistic Risk Assessments. EPRI, Palo Alto, CA: 2017. 3002010663.

31. Seismic Probabilistic Risk Assessment Implementation Guide. EPRI, Palo Alto, CA: 2003.

1002989

32. SQUG Walkdown Screening and Seismic Evaluation Training Course, Revision 4.6. EPRI, Palo Alto, CA: 2016.

References 5-3

33. NEI (K. Keithline) Letter to NRC (D. Skeen), White Paper Supporting Seismic Evaluation Guidance, Criterion for Capacity-Based Selection of Structures, Systems and Components for Fragility Analyses in a Seismic Risk-based Evaluation, Project Code 689, November 28, 2012

34. Seismic Fragility Applications Guide Update. EPRI, Palo Alto, CA: 2009. 1019200.

35. Seismic Fragility Application Guide. EPRI, Palo Alto, CA: 2002. 1002988

36. Methodology for Developing Seismic Fragilities. EPRI, Palo Alto, CA: 1994. TR-103959

37. High Frequency Program: Application Guidance for Functional Confirmation and Fragility Evaluation. EPRI, Palo Alto, CA: 2015. 3002004396

38. ASCE 7-16, Minimum Design Loads and Associated Criteria for Buildings and Other Structures, 2016.

39. NUREG-1742, Perspectives Gained from the Individual Plant Examination of External Events (IPEEE) Program, Final Report, Volumes 1 and 2, US NRC, April 2002

40. NRC (W. Dean) Letter to All Power Reactor Licensees et. al., Final Determination of Licensee Seismic Probabilistic Risk Assessments Under the Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(F) Regarding Recommendation 2.1 "Seismic" of the Near-Term Task Force Review of Insights from the Fukushima Dal-Ichi Accident, October 27, 2015 (ML15194A015)

41. NRC (M. Franovich) Letter to Duke Energy (E. Kapapoulous, Catawba Nuclear Station, Units 1 and 2, and McGuire Nuclear Station, Units 1 and 2, Screening and Prioritization Results Regarding Seismic Hazard Reevaluations for Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dal-Ichi Accident, December 22, 2016 (ML16344A313)

A-1 A

IDENTIFYING SEISMIC CORRELATED OR SEISMIC INTERACTION SCENARIOS FOR CONSIDERATION IN 50.69 CATEGORIZATION Seismic Probabilistic Risk Assessments (SPRAs) have been conducted for a large number of nuclear power plants worldwide in the last 35 years. The methodology has progressed during that period of time and is currently well established with several technical references documenting the methodology. Seismic PRA is different from a full power internal events (FPIE) PRA in two important ways: (a) all possible levels of earthquakes along with their frequencies of occurrence and consequential damage to plant systems and components should be considered, and (b) earthquakes can simultaneously damage multiple redundant components due to the common cause effect of the earthquake. This common cause effect has traditionally been referred to as seismic correlation in the SPRA technical literature. A separate but related potential common cause effect from earthquakes consists of a phenomenon referred to as seismic systems interactions. Seismic systems interaction consists of the failure, displacement or action (for example, spraying from failed piping, impacts from failing block walls) of a structure, system or component (SSC) that negatively affects the credited function of other SSCs in the SPRA.

One of the key seismic insights from the trial studies documented in Section 3 of this report is the importance of considering seismic correlation effects on the 50.69 HSS categorization of plant SSCs. The correlation of SSCs that exists in a seismic event is not typically captured in the FPIE PRA or the fire PRA. As a result, for 50.69 categorization purposes, the Tier 2 plants meeting the criteria in Section 2.3 should include these seismic correlation and interaction insights when performing system categorization. Figure 2.4 provides an overview of the process for the seismic correlated failure assessment and Section 2.3.1 provides the details of that seismic correlation assessment. The purpose of this appendix is to provide an approach to identify the SSCs considered to be seismically correlated (Item 5a in Figure 2.4) and to identify seismic interaction scenarios (Item 5b in Figure 2.4) which could affect the 50.69 categorization.

A.1 Background on Seismic Correlation Considerations in SPRAs The first attempt to programmatically treat the dependencies between seismic responses and between seismic capacities of components was in the seismic risk methodology developed for the Seismic Safety Margins Research Program (SSMRP) at the Lawrence Livermore National Laboratory [27]. The local responses of different components located at different elevations in various buildings were represented by a joint lognormal distribution; similarly, the seismic capacities of these components were also represented by a joint lognormal distribution. This SSMRP methodology consisted of a detailed set of calculations to develop partial correlation coefficients for each of the structures, systems and components (SSCs) in the plant logic model.

Because the application of this methodology was both computationally intensive and data intensive, it was not used in subsequent SPRAs.

Identifying Seismic Correlated or Seismic Interaction Scenarios for Consideration in 50.69 Categorization A-2 Using the results of the SSMRP methodology to perform two SPRAs as trial applications (for Zion and LaSalle), a Sandia Laboratory study [28] developed simplified rules for assigning the response correlation coefficient, thus bypassing the case-by-case SSC partial correlation computations. These simplified rules are provided in Table A-1.

Table A-1 Correlation Guidance from Sandia National Laboratory Study Rule #

Correlation Guidance 1

Components on the same floor slab and sensitive to the same spectral frequency range (that is, ZPA, -10 Hz. or 10-Hz) will be assigned response correlation = 1.0.

2 Components on the same floor slab sensitive to different ranges of spectral acceleration will be assigned response correlation =

3 Components on different floor slabs (but in the same building) and sensitive to the same spectral frequency range (ZPA, -10 Hz or 10-Hz) will be assigned response correlation =

4 Components on the ground surface (outside etc.) shall be treated as if they were on the grade floor of an adjacent building valve configurations (either parallel or series) will have response correlation = 1.0.

All other configurations will have response correlation equal to zero.

Recent reports by the NRC [29] and EPRI [30] propose methods to address seismic correlation.

Neither correlation methodology has been piloted to date and will need to be evaluated in order to understand the costs, benefits and limitations of the recommended approaches.

While the studies summarized above proposed a partial correlation characterization, the state of the practice in SPRAs consists of a binary (zero or one) correlation factor. Debate among the SPRA practitioners as to the accuracy, the cost/benefit and the lack of pilot applications of the partial correlation approaches has led to the use of this more simplified binary approach for most SPRAs conducted to date. However, the research associated with these partial correlation studies have laid the foundation for the decisions made in the simplified binary approach and serve to guide the decisions in SPRAs practiced today. For the 50.69 categorization program, the current state of practice (binary approach) for the treatment of correlation is applied.

A.2 Approach Figure 2-3 outlines the approach for identifying unique HSS components for Tier 2 plants. Step 5 of the process consists of a seismic walkdown focused on identifying those SSCs in the system being categorized that would either be (1) evaluated to be seismically correlated in the event of an earthquake or (2) evaluated to be subject to common cause seismic interactions. Confirmatory seismic walkdowns integrated with plant documentation reviews (that is general arrangement drawings and previous seismic walkdown documentation) are the basis for identifying correlations and seismic interactions within Step 5 of the recommended 50.69 categorization process.

5 15 0.5.

5 15 0.75.

tanks, 5

"G anged" 6

Identifying Seismic Correlated or Seismic Interaction Scenarios for Consideration in 50.69 Categorization A-3 Seismic walkdown methods have been documented in past SPRA and SMA methodology reports, including [19], [18] and [31]. In addition, EPRI offers a training course [32] that focuses on the seismic walkdown and also provides additional information on the identification and assessment of seismic interactions. The methods and qualifications for these seismic walkdowns and seismic interaction reviews are well documented in these references and will not be repeated within this report.

The seismic fragility of an SSC can be broken down into two fundamental elements: the seismic capacity is a measure of the strength of the SSC and the seismic demand is a measure of the accelerations/displacements induced by the earthquake at the SSC location. The binary method for the identification of correlated/uncorrelated SSCs in an SPRA is to assign either 100%

correlation or 0% correlation for the fragilities associated with each set of SSCs being addressed.

Since many SSCs could be judged to have some degree of correlation in either the seismic capacity or the seismic response, the ultimate binary correlation decision is typically a judgment of engineers experienced in both seismic capacity and seismic response fields.

The following guidance from references [18] and [31] summarize the seismic correlation process and judgments made in most SPRAs and are the recommended guidance for identifying seismically correlated conditions for moderate seismic hazard plants as described in Section 2.3.1.

1. Review available documentation (general arrangement drawings, previous seismic walkdown documentation, etc.) in advance of the walkdown to support the correlation assessments.

2. Perform a confirmatory walk down of the system being categorized to confirm the characteristics described below.

3. Similar SSCs subject to similar seismic response are assumed to be perfectly correlated (factor = 1.0) and should be included in the Section 2.3.1 evaluation. This includes the following conditions.

a. Similar equipment on the same floor of a structure are typically judged to be fully correlated.

b. Similar equipment on adjacent floors of a structure (resulting in similar demand) are also typically considered to be correlated [29, 30] if the equipment have similar failure modes and fundamental frequencies. As summarized in [18], the Diablo Canyon Long Term Seismic Program performed a more detailed review of seismic correlations and concluded that a high degree of correlation existed between items of similar natural frequencies located on different floors in the same structure.

c. Similar equipment in different but similarly constructed buildings on the same basemat are also judged to be correlated based on the assumption of similar seismic demand.

4. SSCs with different types of failure modes are treated as uncorrelated (correlation factor = 0) and do not need to be included in the Section 2.3.1 evaluation.

Identifying Seismic Correlated or Seismic Interaction Scenarios for Consideration in 50.69 Categorization A-4

5. Similar SSCs but with significantly different seismic demands are treated as uncorrelated (correlation factor = 0) and do not need to be included in the Section 2.3.1 evaluation.

Examples include:

a. Similar SSCs with similar failure modes but located in different structures, and

b. Similar SSCs with similar governing failure modes located in the same structure, but with significantly different seismic responses.

These correlation guidelines are provided to assist in the identification of SSCs judged to be seismically correlated. Additional guidance is provided in [18] and [31] to support the decisions made on the walkdown. Following completion of the walkdown, the list of correlated SSCs identified should be placed into Step 6 from Figure 2-3.

The second part of the 50.69 categorization walkdown includes the evaluation for seismic interactions which could cause correlated failures within the system being categorized. Potential seismic interactions should be evaluated during the system walkdown to assess whether any credible interactions could result in correlated failures of equipment within the system being categorized. As mentioned above, the approaches for evaluating seismic interactions are well documented in technical references and will not be repeated in this appendix. For purposes of describing the process recommended in this appendix, it is informative to define terminology associated with seismic interaction assessments:

Interaction Source - the source is a structure, system or component (SSC) that causes the seismic interaction. The sources of seismic interactions can be based on falling items, deflecting items or flood initiators. So an example of a typical seismic interaction source would be an unreinforced block wall or a failed water storage tank that floods an area.

Interaction Target - the target is the SSC that is being evaluated and is required to maintain its safety function or pressure boundary as part of the seismic risk assessment being conducted. For purposes of this 50.69 correlation evaluation, the equipment in the system being categorized will generally be considered as the targets.

The process for assessing the potential for correlated seismic interactions during the walkdown should consist of the following steps:

1. Review available documentation (general arrangement drawings, previous seismic walkdown documentation, etc.) in advance of the walkdown to support the seismic interaction assessments

2. Perform a confirmatory walk down of the system being categorized to confirm the characteristics described below.

3. Determine if any credible seismic interactions exist in the vicinity of the SSCs being categorized. The walkdown team should screen out those seismic interaction sources not deemed credible based on their experience and training. The walkdown team should also screen out credible sources that would not be expected to damage/fail the target equipment in the system being categorized.

4. Those seismic interaction sources that are not screened out during the walkdown) should be assessed using the methods documented in Appendix B to determine if they may be screened out as high capacity seismic interaction sources.

Identifying Seismic Correlated or Seismic Interaction Scenarios for Consideration in 50.69 Categorization A-5

5. The remaining seismic interactions that could represent a common cause event (affecting more than a single SSC in the system being categorized) should be added to the list of correlated SSCs identified and evaluated per the Step 6 diamond from Figure 2-3.

Past SPRAs have identified several SSC categories [29] that have been frequently classified as being correlated and, at the same time, their correlation or dependency made a difference to baseline seismic CDF or to the safety insights.

Typical Interaction Sources Typical Interaction Targets Masonry walls Non-safety related structures housing safety related equipment Large tanks: condensate storage tanks or other similar tanks (flooding source)

Batteries and racks Electrical cabinets: motor control centers and switchgear Small tanks: diesel generator fuel oil day tanks Heat exchangers: such as component cooling water heat exchangers Mechanical equipment: long shafted service-water pumps, horizontal auxiliary feed water pumps This list is not intended to be a limiting set for this assessment, instead it serves as operating experience from past SPRAs to be used in the walkdown and correlation assessment to ensure these items are given the appropriate focus.

B-1 B

CRITERIA FOR CAPACITY-BASED SCREENING FOR HIGH CAPACITY SSCS Seismic risk insights from past SPRA and SMA studies have shown that high seismic capacity SSCs from the SPRA Seismic Equipment List (SEL) do not typically contribute to the seismic risk. Similarly, those seismic interaction scenarios (for example, block walls, falling objects, and displacements which cause impact with nearby elements) which can be demonstrated to have high seismic capacities, have also not resulted in significant risk contribution in past seismic studies. Therefore, these high seismic capacity SSCs and interactions are unlikely to be categorized as HSS and can be screened out from the 50.69 seismic categorization process. This high seismic capacity screening fits into Step 5c of the flow chart in Figure 2-3. The process for screening individual SSCs documented in EPRI 1025287 [11] (the SPID) will form the backbone for this screening approach. Following this approach, SSCs with a HCLPF capacity greater than the calculated screening level HCLPF could be categorized as low safety significant (LSS).

B.1 Approach As part of the effort to develop the SPID [11], seismic capacity-based criteria were developed to determine which SSCs should have component specific calculated fragility values to ensure that proper focus was given to those SSCs with the potential to be risk-significant. These criteria were developed using a parametric/sensitivity study [33] which provided the basis for the SPID recommendations. SSCs with capacities above the calculated screening level are not expected to have significant impact on the result of the SPRA analyses, the ranking of accident sequences, or the calculated sequence-or plant-level seismic CDF or LERF values. As such, SSCs with capacities above that screening level would also not be expected to be high safety significant (HSS) components within the 50.69 categorization process.

Section 6.4.3 of the SPID [11] identifies the approach to develop a screening HCLPF value for these higher capacity fragilities. Following the SPID approach, a screening HCLPF value is calculated by convolving the fragility of a single element with the site-specific hazard curve such that the SCDF is at most about 5E-7 per year. This can be done with trial and error runs using a quantification code or with a spreadsheet with an assumed composite variability (for example, c= 0.4) as described in [11]. This 5E-7 screening criteria was developed for the higher seismic hazard plants where seismic typically has a corresponding higher resulting risk. For a medium to low seismic hazard site this screening level of 5E-7 could potentially be unconservative, therefore an SCDF value of approximately 1/2 of the SPID value, or 2.5E-7 is judged to be more appropriate for purposes of this 50.69 categorization screening assessment.

Other appropriately justified site-specific screening values may be used.

To apply his approach, a seismic fragility must be developed for each SSC that is being assessed as part of the categorization process and compared to screening level developed as described above. The fragility methodology is well established and there are numerous references in the g

Criteria for Capacity-Based Screening for High Capacity SSCs B-2 literature describing the methods. Four EPRI reports that collectively capture the fragility process are listed in Table B-1.

Table B-1 Seismic Fragility References Topic Title Reference Seismic Fragility Update EPRI Report 1019200 34]

]

Methodology for Developing Seismic Fragilities EPRI TR-

]

A Methodology for Assessment of Nuclear Plant Seismic Margin

-SL (1991 19]

For nuclear plants without existing SPRAs, one challenge will be to produce in-structure seismic responses for use in these fragilities. Development of finite element models and generation of new seismic response analyses using the current seismic hazard shape at the plant site is one option, however, more simplified and conservative approaches could be used when justified by experienced engineers within the structural dynamics field. These approaches include:

Scaling of existing plant seismic response analyses where the shapes of the uniform hazard response spectra (UHRS) are similar [35, 19]

Estimation of high frequency seismic response using an approach in EPRI 3002004396 [37]

which describes a process to estimate seismic responses for hard rock sites that have ground response spectral peaks in the high frequency part of the response spectrum In addition, it may also be possible for fragility analysts to conservatively estimate seismic demands using simplified approaches documented in ASCE 7 [38] for justifying additional SSCs that would have HCLPF capacities above the screening threshold. Assessments made would have to be necessarily conservative (biased towards higher in-structure response spectra (ISRS))

and account for potential variability of ISRS results based on the use of these approximate methods.

B.2 Justification While the SPID capacity-based screening approach is intended as a tool to be used for seismic risk assessments to focus fragility resources on risk-significant SSCs, the concept can be extended to 50.69 categorization. The capacity-based screening approach from the SPID is purposely conservative and is based on a single element leading directly to core damage. In addition, the recommended approach in this Appendix conservatively reduces the SPID target SCDF of 5E-7 by 50%, resulting in a more conservative SCDF value of 2.5E-7. If it is possible to demonstrate a component has a HCLPF above the calculated screening threshold, that component is not expected to be risk-significant in an SPRA. So even in the absence of a formal risk assessment, it is possible to identify certain SSCs with high seismic capacity that would not be expected to be risk-significant.

Seismic Fragility Applications Guide (2009) [

Seismic Fragility Application Guide EPRI 1002988 (2002) [35 Guidance 1 03959 ( 1994) [36 EPRI NP 6041

)[

Criteria for Capacity-Based Screening for High Capacity SSCs B-3 B.3 Conclusion Use of the capacity-based screening approach based on a similar approach documented in the SPID is an acceptable method to screen SSCs into the LSS category for 50.69 categorization.

When SSCs are determined to have HCLPFs greater than this screening level HCLPF, it can be concluded that they would not be risk significant in an SPRA; therefore, those SSCs can be classified as LSS rather than HSS.

Electric Power Research Institute 3420 Hillview Avenue, Palo Alto, California 94304-1338 *

-0813

• USA 800.313.3774

• com

• www.epri.com The Electric Power Research Institute, Inc.

(EPRI, www.epri.com) conducts research and development relating to the generation, delivery and use of electricity for the benefit of the public. An independent, nonprofit organization, EPRI brings together its scientists and engineers as well as challenges in electricity, including reliability, efficiency, affordability, health, safety and the environment. EPRI also provides technology, policy and economic analyses to drive long-range research and development planning, and supports research in emerging technologies. EPRI members represent 90% of the electricity generated and delivered in the United States with international EPRIs principal offices and laboratories are located Tenn.;

TogetherShaping the Future of Electricity

© 2020 Electric Power Research Institute (EPRI), Inc. All rights reserved.

Power Research Institute, Inc.

Electric Power Research Institute, EPRI, and TOGETHER... SHAPING THE FUTURE OF ELECTRICITY are registered service marks of the Electric experts from academia and industry to help address participation extending to nearly 40 countries.

in Palo Alto, Calif.; Charlotte, N.C.; Knoxville, Dallas, Texas; Lenox, Mass.; and Washington, D.C.

3002017583 PO Box 10412, Palo Alto, California 94303 650.855.2121 askepri@epri.